Re: Logging User Activity

[Michelle Konzack <linux4michelle@freenet.de>]

Am 12:39 2003-05-14 -0500 hat Nathan E Norman geschrieben:
>
>On Wed, May 14, 2003 at 06:26:16PM +0100, Michael Parkinson wrote:
>> [ I wrote ]
>> > On Wed, May 14, 2003 at 03:33:36PM +0100, Michael Parkinson wrote:
>> > > Dear All,

>Well, where you log to is up to you, but that wasn't my question :-)
>
>What activity are you trying to log?  Activity on machines (user a ran
>this, consumed this much cpu time, etc.) or activity on the network
>(user b accessed this site, consumed this much bandwidth, etc.) ?
>
>The latter is far more difficult: how do you know that a packet was
>caused by user b's activity?

Where is the problem ??? 

I will asume, that user login only on the machine and not remotely... 

Ther is a Debian-Package which log the users login-time this can you 
redirect to a logging server. The login is loged with the machinename/IP. 

Then, you log the traffic with ipac and write a script, which compare 
the logfiles by time...

Now you have the users TCP/IP activity logged. 

I do this in my Secure-Network

have a nice day
Michelle