Como monitorar as atividades dos usuários no sistema Linux
Autor: Marcio Sardinha | Publicado: 2014-02-23T07:29:00-08:00


Ambas, psacct e acct, possuem o mesmo propósito.&nbsp;

&nbsp;INSTALAÇÃO

Em distros RedHat:&nbsp;

sudo yum install psacct

Para garantir que o serviço funcione normalmente, execute o comando:&nbsp;

sudo /etc/init.d/psacct start

Em distros Debian:&nbsp;

sudo apt-get install acct

USANDO A FERRAMENTA

Todos os comandos abaixo foram executados com o usuário "root"


Aqui estão alguns exemplos de uso para a ferramenta:&nbsp;

- Exibindo o tempo total de conexões (horas) de todos os usuários presentes no sistema&nbsp;

[root@linux10complica ~]# ac
total &nbsp; &nbsp; &nbsp; 27.99

- Exibindo o tempo total de conexões (horas) de cada usuário&nbsp;

[root@linux10complica ~]# ac -p
ricardo 2.04
root 28.02&nbsp;
total 30.06

- Exibindo o tempo total de conexões (horas) por dia de cada usuário&nbsp;

[root@linux10complica ~]# ac -d ricardo
May &nbsp;1 &nbsp; &nbsp;total &nbsp; &nbsp; &nbsp; &nbsp;1.24&nbsp;
May &nbsp;2 &nbsp; &nbsp;total &nbsp; &nbsp; &nbsp; &nbsp;2.19&nbsp;
May &nbsp;3 &nbsp; &nbsp;total &nbsp; &nbsp; &nbsp; &nbsp;1.11&nbsp;
Today &nbsp; &nbsp; total &nbsp; &nbsp; &nbsp; &nbsp;3.42

- Exibindo os últimos comandos executado pelos usuários&nbsp;

[root@linux10complica ~]# sa -u
root &nbsp; &nbsp; &nbsp; 0.00 cpu &nbsp; &nbsp; &nbsp;900k mem &nbsp; &nbsp; &nbsp;0 io udev-acl.ck &nbsp; &nbsp;&nbsp;
root &nbsp; &nbsp; &nbsp; 0.00 cpu &nbsp; &nbsp; 4320k mem &nbsp; &nbsp; &nbsp;0 io gdbus &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;
ricardo &nbsp; &nbsp;0.00 cpu &nbsp; &nbsp; &nbsp;536k mem &nbsp; &nbsp; &nbsp;0 io locale &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
ricardo &nbsp; &nbsp;0.00 cpu &nbsp; &nbsp; &nbsp;572k mem &nbsp; &nbsp; &nbsp;0 io grep &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
ricardo &nbsp; &nbsp;0.00 cpu &nbsp; &nbsp; &nbsp;554k mem &nbsp; &nbsp; &nbsp;0 io sh

- Exibindo os últimos comandos executado por cada usuário (detalhadamente)&nbsp;

[root@linux10complica ~]# lastcomm
dpkg &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ricardo &nbsp;__ &nbsp; &nbsp; &nbsp; &nbsp; 0.00 secs Sun Feb 23 11:49
dpkg &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ricardo &nbsp;__ &nbsp; &nbsp; &nbsp; &nbsp; 0.00 secs Sun Feb 23 11:49
lsb_release &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;ricardo &nbsp;__ &nbsp; &nbsp; &nbsp; &nbsp; 0.02 secs Sun Feb 23 11:49
sudo &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; S &nbsp; &nbsp; ricardo &nbsp;pts/0 &nbsp; &nbsp; &nbsp;0.00 secs Sun Feb 23 11:49
apt-get &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;S &nbsp; &nbsp; root &nbsp; &nbsp; pts/0 &nbsp; &nbsp; &nbsp;0.58 secs Sun Feb 23 11:49

- Exibindo os últimos comandos executado por um usuário específico (detalhadamente)&nbsp;

[root@linux10complica ~]# lastcomm ricardo
dpkg &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ricardo &nbsp;__ &nbsp; &nbsp; &nbsp; &nbsp; 0.00 secs Sun Feb 23 11:49
dpkg &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ricardo &nbsp;__ &nbsp; &nbsp; &nbsp; &nbsp; 0.00 secs Sun Feb 23 11:49
lsb_release &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;ricardo &nbsp;__ &nbsp; &nbsp; &nbsp; &nbsp; 0.02 secs Sun Feb 23 11:49
sudo &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; S &nbsp; &nbsp; ricardo &nbsp;pts/0 &nbsp; &nbsp; &nbsp;0.00 secs Sun Feb 23 11:49

- Exibindo os últimos usuários que executaram determinado comando&nbsp;

[root@linux10complica ~]# lastcomm locate
locate &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ricardo &nbsp;__ &nbsp; &nbsp; &nbsp; &nbsp; 0.00 secs Sun Feb 23 10:14
locate &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ricardo &nbsp;__ &nbsp; &nbsp; &nbsp; &nbsp; 0.00 secs Sun Feb 23 10:14
locate &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ricardo &nbsp;__ &nbsp; &nbsp; &nbsp; &nbsp; 0.00 secs Sun Feb 23 10:14
locate &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ricardo &nbsp;__ &nbsp; &nbsp; &nbsp; &nbsp; 0.00 secs Sun Feb 23 10:14