On Fri, Jan 29, 2010 at 3:12 AM, Rajagopal Swaminathan
<raju.rajsand@xxxxxxxxx> wrote:
> Greetings,
>
> How does one monitor if a site is being accessed using browser?
>
> IOW, I just want to know if a user has launched a session thru Firefox.
>
> I basically want to know if a user has tried to access the webserver
> and unable to reach it and log such instances.
>
> I am using cron and curl to seperately monitor the link.
>
> Any clues?
It is possible using the auditd subsysted. You'd need to define a rule
to match that user and firefox. I don't have the exact syntax, but the
rule I use for root in audit.rules is:
-a entry,always -S open -S close -S read -S write -S link -S unlink -S
chmod -S chown -S execve -F uid=root -k root_activity
If you do a man on auditctl it can show the options. You could, for
example, generate a rule whenever a particular user launches firefox,
etc..
_______________________________________________
CentOS mailing list
CentOS@xxxxxxxxxx
http://lists.centos.org/mailman/listinfo/centos
