How to Track Linux User Activity using Log Accounting

If you want to keep track and monitor details of user activity in the Linux operating system and get a file of the log then you can use the accton command provided by acct module. It will provide you ultimate solution to track Linux user activity using log accounting.

If the acct is not already installed on your system, then run the following to install it;

RHEL:   $ yum install psacct
Ubuntu: $ sudo apt-get install acct

Once you installed, you have to turn on the log accounting. You can actually toggle on/off the account logging using accton command.

Track Linux User Activity using Log Accounting

You can turn on the accounting by running the following;

$ accton on

By default, this command will start storing the details user activity log at /var/log/account/pacct. But you can specify the file directory depends on your own flavors, For example;

$ accton on /tmp/log.txt

You can also check if the log file currently is being logging or not by running;

$ systemctl status psacct
or
$ systemctl status acct

If it is running then you should back;

Linux accton Command

If you want to turn off the account logging, run;

$ accton off

SEE: Linux accton Command.

Posted in