Process accounting

legolasthehansy
legolasthehansy used Ask the Experts™
on
Hi Experts,

Has anyone configured psacct package on workstations and send them to a remote syslog server. Here is the scenario,
We have a Red Hat development farm and we need to monitor user activity, process; log and send them to a remote syslog server and trigger alerts if suspicious activity is seen. I have come across the pacct tool but might need to work further on triggers which we can do it at a later stage but before that I need to see if data generated using pacct (namely wtmp, btmp, lastlog etc..) can be sent to remote.
Let me know.

Thanks,
lego
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®

Author

Commented:
Adding further - I have already configured the workstations to send all logs to remote syslog server;

vi /etc/syslog.conf
*.* @ip_address
service syslog restart

I guess the above is not enough and is independent of the psacct tools.

Regards,
lego
Distinguished Expert 2017
Commented:
The above will direct any event seen by syslogd to forward to the remote.

You might want to look at rsyslog http://www.rsyslog.com/ which replaces syslogd and has added functionality.

However, using syslog mechanism might not be the best approach due to the amount of information.

You could setup cron jobs to monitor the various psacct information and adding them to a database or something like that as well as include logic that would generate an event to syslog as an alert.

What information is collected
http://www.generationip.com/documentation/system-documentation/113-howto-on-psacct-for-a-complete-monitoring-of-processus-and-users-activities-on-your-system 

Author

Commented:
Data collected by psacct cannot be sent to a remote syslog server. One thing which can be done is to dump the output of psacct utilities periodically (using a cron) to an NFS share and then use a utility to read them off the NFS server.

I'm closing this case. Thanks arnold for your suggestion

Author

Commented:
Thanks for your helpful suggestion.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial