Monitor user activity in Linux

Overview

Monitor user activity in Linux에 대한 기술 문서입니다.

Summary

• 무엇인가? - Monitor user activity in Linux
• 왜 필요한가? - HPC 및 서버 환경에서 필수 개념
• 언제 사용하는가? - 서버 구성, 성능 튜닝, 문제 해결 시

---

Purpose

이 문서가 존재하는 이유

• Goal: Monitor user activity in Linux에 대한 기술 정보 제공
• Scope: Monitor user activity in Linux의 개념, 사용법, 설정
• Non-goals: 다른 주제로의 확장

---

Key Concepts

Concept	Description	Related
Monitor user activity in Linux	HPC/서버 환경에서 중요한 기술 개념	Linux, Server

---

Detailed Explanation

On Linux-based systems, process accounting offers useful information to assist you in monitoring user activities. Process accounting is a way of keeping track of and summarizing processes and commands on a system. Monitoring user activity in Linux systems is crucial for ensuring system security, optimizing resource usage, and identifying potential issues. By keeping track of user actions, administrators can gain valuable insights into system behavior, detect unauthorized activities, and troubleshoot performance problems. With psacct, admin can enable process accounting, view accounting records, and analyze data using tools like sar and sadf. Acct complements psacct by providing additional features such as command monitoring and file access tracking.

• psacct tracks the system resources utilized by users and processes. It collects detailed information such as CPU usage, memory consumption, disk I/O, and executed commands.
• acct is another utility that provides process accounting capabilities in Linux systems. It captures user activities by monitoring commands executed, system calls made, and file access operations

The main features of psacct are

• Resource Monitoring − psacct tracks the resource usage of processes, enabling administrators to monitor CPU, memory, and disk usage at a granular level.
• Command Execution Tracking − It records the commands executed by users, providing visibility into the actions performed on the system.
• Reporting and Analysis − psacct offers tools to generate reports and analyze the collected data, allowing administrators to make informed decisions based on system usage patterns

Key features of acct include −

• Command Execution Logging − acct records the commands executed by users, including their arguments and execution times.
• System Call Tracing − It captures system calls made by processes, providing insights into the interactions between user programs and the operating system.
• File Access Monitoring − acct logs file operations, giving visibility into file reads, writes, and deletions performed by users or processes.

# install and configure psacct
$sudo apt-get install psacct    #Ubuntu
# The main configuration file for psacct is usually located at /etc/psacct/psacct.conf
# Enable and start psacct
$sudo systemctl enable psacct
$sudo systemctl start psacct

---

Best Practices

• 최신 버전 사용 권장
• 공식 문서 참고
• 테스트 환경에서 먼저 검증

---

References

• Monitor user activity in Linux

---

Related Pages

• Linux
• Server
• Hardware
• Network

---

Knowledge Graph

Related

→ Linux Kernel Tuning → systemd → LVM → iptables → Ubuntu → fstab → Linux Kernel