Auditing and tracking abnormal activities in Linux

Article title: auditing and tracking abnormal activities in Linux. Linux is a technology channel of the IT lab in China. Includes basic categories such as desktop applications, Linux system management, kernel research, embedded systems, and open source.

Some abnormal users try to migrate all activity records on the system (for example ~ /. Bash_history), but we can use dedicated tools to monitor the commands executed by all users. We recommend that you use process accounting to record your activities. you can use process accounting to view the commands executed by each user, including CPU time and memory usage.

The Psacct program provides several process activity monitoring tools: ac, lastcomm, accton, and sa.

◆ The ac command displays the user connection time statistics.

◆ The lastcomm command displays the commands executed by the system.

◆ The accton command is used to enable or disable the process accounting function.

◆ Sa command is used to count the accounting of system processes.

1) install the psacct or acct software package

If you use RHEL, use the up2date command:

# Up2date psacct

If you use CentOS/Fedora Core Linux, use the yum command:

$ Sudo apt-get install acct

Or

# Apt-get install acct

2) start the psacct/acct service

On Ubuntu/Debian Linux, pacct can be automatically started. (The installation package creates a/var/account/pacct file on the system ). However, in Red Hat/Fedora Core/Cent OS, you need to manually start the psacct service. Run the following two commands to create the/var/account/pacct file and start the pacct service:

# Chkconfig psacct on

#/Etc/init. d/psacct start

If you use Suse Linux and the service name is acct, run the following command:

# Chkconfig acct on

#/Etc/init. d/acct start

Now we can learn how to use these tools to monitor user commands and time.

3). display the statistics of the user's connection time

The command prints the user's connection time (in hours) on the screen based on the number of logins/exits ). The total time can also be printed. If you execute an ac command without any parameters, the screen will display the total connection time:

$ Ac

[1] [2] [3] Next page