On Fri, Jan 29, 2010 at 3:12 AM, Rajagopal Swaminathan raju.rajsand@gmail.com wrote:
Greetings,
How does one monitor if a site is being accessed using browser?
IOW, I just want to know if a user has launched a session thru Firefox.
I basically want to know if a user has tried to access the webserver and unable to reach it and log such instances.
I am using cron and curl to seperately monitor the link.
Any clues?
It is possible using the auditd subsysted. You'd need to define a rule to match that user and firefox. I don't have the exact syntax, but the rule I use for root in audit.rules is:
-a entry,always -S open -S close -S read -S write -S link -S unlink -S chmod -S chown -S execve -F uid=root -k root_activity
If you do a man on auditctl it can show the options. You could, for example, generate a rule whenever a particular user launches firefox, etc..