Paul DiSciascio on 13 Aug 2009 14:15:30 -0700

[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]

Re: [PLUG] logging user activity

On Aug 13, 2009, at 4:58 PM, JP Vossen wrote:
> The only way you can *almost* guarantee capturing all user activity is
> to modify the kernel to do so.

Right, auditing is a kernel subsystem, which you can tune to make it  
tell you anything that gets touched, run, created, by whom, and via  
what command.  Sure, it wont capture keystrokes, but I dont think very  
many people are interested in seeing all of the ^H^H^H^H's from a  
typical user.  This all really depends on the use case.


Philadelphia Linux Users Group         --
Announcements -
General Discussion  --