[CentOS] Browser related question

Kwan Lowe kwan.lowe at gmail.com
Fri Jan 29 10:43:41 UTC 2010


On Fri, Jan 29, 2010 at 3:12 AM, Rajagopal Swaminathan
<raju.rajsand at gmail.com> wrote:
> Greetings,
>
> How does one monitor if a site is being accessed using browser?
>
> IOW, I just want to know if a user has launched a session thru Firefox.
>
> I basically want to know if a user has tried to access the webserver
> and unable to reach it and log such instances.
>
> I am using cron and curl to seperately monitor the link.
>
> Any clues?

It is possible using the auditd subsysted. You'd need to define a rule
to match that user and firefox. I don't have the exact syntax, but the
rule I use for root in audit.rules is:

-a entry,always -S open -S close -S read -S write -S link -S unlink -S
chmod -S chown -S execve -F uid=root -k root_activity


If you do a man on auditctl it can show the options. You could, for
example, generate a rule whenever a particular user launches firefox,
etc..


More information about the CentOS mailing list