On Fri, Jan 29, 2010 at 10:12 AM, Rajagopal Swaminathan raju.rajsand@gmail.com wrote:
Greetings,
How does one monitor if a site is being accessed using browser?
IOW, I just want to know if a user has launched a session thru Firefox.
I basically want to know if a user has tried to access the webserver and unable to reach it and log such instances.
I am using cron and curl to seperately monitor the link.
Any clues?
Centos 5.2/Gnome/Firefox 3.0.16
Regards
Rajagopal
why not to try do this with iptables with combination with inotify from man iptables --uid-owner userid Matches if the packet was created by a process with the given effective user id.
--gid-owner groupid Matches if the packet was created by a process with the given effective group id. --cmd-owner name Matches if the packet was created by a process with the given command name. (this option is present only if iptables was compiled under a kernel supporting this feature)
then adding in iptables rule -j LOG --log-level 4 --log-prefix "some_prefix "
secondly you can watch connection states with commands: -m state --state NEW SYN packet was sent -m state --state ESTABLISHED,RELATED you are getting response
and then in syslog.conf kern.warning /var/log/iptables.log
you then can watch with inotify /var/log/iptables.log file and do whatever you should
Also i would watch not only trafiic to external tcp 80 port, but also and tcp/udp 53 port.
browser can even don't try to load page if it doesn'i resolve dns name, or entered domain does not exist.