is there a way of logging of user activities in TC?

[jamtat]

What I'd like to be able to do on the lab computers I've set up with TC is log user actions. What I mean by that is I'd like, when a user starts an application, for that action, with a time stamp, to be recorded in some log file. The purpose is to help me to determine how much use the computers are getting and also to help in back-tracking issues, should any problems arise.

It seems like doing this must be possible but I'm drawing a blank thus far on how to do it. Web searches have so far not turned up much either. I should also mention that the computers get very little use--maybe they get used briefly once a day--so I'm not really concerned about ballooning log files. On rare occasions, they might get used a few times per day. Also, the systems have only one user, the default tc account and that's the account, of course, whose actions I want to monitor.

Can anyone offer a suggestion for how I might make the system write to a log file the application name and a time stamp each time a user on these machines opens and uses a program?

TIA, James

[Rich]

Hi jamtat
I don't know if there are any pre-canned applications to do this, but you can do this yourself by
setting up scripts to monitor the applications of interest. I don't do scripting, but it would look
something like this:

Code: [Select]

echo `date` APPLICATION_NAME started >> LOGFILE_NAME
command to start application goes here
echo `date` APPLICATION_NAME stopped >> LOGFILE_NAME

[jamtat]

Thanks for your input, Rich. I'm not really understanding what you mean when you say "scripts": are you talking about a bash script? So it's a bash script that first writes data to the log file, then starts the program, then writes to the log files again when the application is closed (the latter sort of recording is not needed in my case, incidentally)? Let me propose a bash script example that may be within my limited competence and call it "firefox-start":

Code: [Select]

#!/bin/sh
echo `date` firefox started >> ~/LOGFILE &&
firefox &&
echo `date` firefox stopped >> ~/LOGFILEIs that the sort of script you're proposing? And that the script would then be made executable and somehow made to execute when the relevant wbar icon is clicked on?

James

[Rich]

Hi jamtat
That is correct.

[jamtat]

It's an interesting idea, Rich, and it does work, as I've proved by trying it on my Arch machine. It also has the virtue of writing only the particular information I need to the log file, thus keeping the file from growing to large proportions. And it could, furthermore, be quite workable in this particular situation, since there's a fairly limited number of programs I allow users to run (maybe 10?).

But there's a problem implementing it due to the non-standard design of TC. I cannot, for example, make persisting changes in /usr/bin (the location of most of the programs whose use I want to track). Then, there's the problem of things allowed/disallowed to appear in wbar (wbar is the only menu on these machines, incidentally). I know there are kludgy ways to deal with this: I could, for example, make a bunch of scripts in /mnt/sda1/tcelocal that would do the job, then, using wbarconf, remove the icons for persistent applications I've installed and replace them with icons representing the scripts I created. But that's a really convoluted and ugly solution. And I know I could accomplish something effective and similarly kludgy by adding various entries to bootlocal.sh. But I think I'll hold out and see whether something a bit more elegant and straightforward might be possible.

Then again, maybe I'm misunderstanding something about your proposal? Further input on this, Rich, or anyone else?

Thanks, James

[gerald_clark]

Read the bash manual, and look for HISTORY.

[Rich]

Hi jamtat
It will take some work, and may get a little messy since you need to insert your script between the
calling mechanism and the application. Some applications are already started by a script. For example,
opera is the link  /usr/local/bin/opera  pointing to the script  /tmp/tcloop/opera10/usr/local/bin/opera.
If you delete the link and copy the script in its place, you could add the logging function to that script
and then add that script to your backup.

[jamtat]

Read the bash manual, and look for HISTORY.

I don't see how bash history applies since my users--if they're even capable of accomplishing this much--will be starting applications by clicking on icons located in wbar?

James

[gerald_clark]

That's the first you have mentioned you are running X.
You could still use bash to start your applications.

[jamtat]

Here's what I've come up with so far along the lines Rich has suggested. First, I create a directory in the home directory that will house the bash scripts; let's call it my-bin (/home/tc/my-bin). In that directory go the scripts--constructed as outlined above--for each of the programs I want to monitor. The next step is to replace the executables for the programs I want to monitor with the bash scripts I've created and that are located in /home/tc/my-bin. To do that, I edit bootlocal.sh.

As a concrete example of how I edit bootlocal.sh, let's say I've installed the Chromium browser and want to monitor when it is started and stopped. The first order of business is to find the name of the executable and its location. The real location of the executable is, of course, at /tmp/tcloop/chromium-browser/usr/local/bin/chromium-browser. But there's a symlink to that executable in /usr/local/bin, and that's where the system looks for the executable when the wbar icon for Chromium is clicked on. We've therefore got to get rid of that symlink and replace it with a symlink to the bash script we'll create in /home/tc/my-bin.

To get rid of the existing symlink we add a line to bootlocal.sh: rm /usr/local/bin/chromium-browser. Then, we create the script in /home/tc/my-bin: touch /home/tc/my-bin/chromium-browser. Somewhat in contrast to what Rich and I proposed above, the content of this new chromium-browser script (it has to have the same name as the original executable) should be as follows:

Code: [Select]

#!/bin/sh
echo `date` Chromium started >> ~/LOGFILE &&
/tmp/tcloop/chromium-browser/usr/local/bin/chromium-browser &&
echo `date` Chromium stopped >> ~/LOGFILE Note that the executable the script calls is the one located in /tmp/tcloop, the one the original /usr/local/bin/chromium-browser file pointed to. Once that script is created and has had chmod +x done to it, we're ready for the final step.

The final step is to create a new symlink to the bash script we've created, a symlink that get's placed in /usr/local/bin every time the system boots--/usr/local/bin being where the system will be looking for the exectuable. That can be done by placing another entry in bootlocal.sh. So, after the line rm /usr/local/bin/chromium-browser, the line ln -s /mnt/sda1/home/tc/my-bin/chromium-browser /usr/local/bin/chromium-browser needs to be added. This scenario assumes, of course, that you have a persistent home directory for your TC installation (sda1 may need to be modified to suit your own particualr scenario). Now, when the system boots and when you click on the Chromium icon in wbar, the program starts normally and the time of its execution and shutdown get recorded in ~/LOGFILE.

This so far seems to me the most straightforward way to implement the solution suggested by Rich. It's still fairly convoluted but, owing to the non-standard design of TC, I'm not sure it could be further simplified. Additional input on this, anyone?

James

[Rich]

Hi jamtat
Instead of removing and then creating the link you can do it in one step like this:

Code: [Select]

ln -sf /mnt/sda1/home/tc/my-bin/chromium-browser /usr/local/bin/chromium-browserThe  f  parameter tells the link command to replace the current destination with the new one.
Something to watch out for is command line parameters. If you look in  /usr/local/tce.icons  you can
see if any are being passed to the application and do likewise.
If you replace the  &&  at the end of your command line with  >> ~/LOGFILE  it could serve to log an
error message if something should go wrong.

[jamtat]

Thanks for the additional tips, Rich. The single-line command does do the job, as you indicate. I guess these scripts will be the answer to my logging needs. I've gone ahead and set it up and now have things working. It was made a bit more troublesome by the fact that I needed to replicate the setup for 3 machines and had difficulty getting sshd going on one of them--but that's another story. I was able to fall back on dropbox for copying the files between machines.

James