On Fri, Jan 29, 2010 at 3:12 AM, Rajagopal Swaminathan <raju.rajsand at gmail.com> wrote: > Greetings, > > How does one monitor if a site is being accessed using browser? > > IOW, I just want to know if a user has launched a session thru Firefox. > > I basically want to know if a user has tried to access the webserver > and unable to reach it and log such instances. > > I am using cron and curl to seperately monitor the link. > > Any clues? It is possible using the auditd subsysted. You'd need to define a rule to match that user and firefox. I don't have the exact syntax, but the rule I use for root in audit.rules is: -a entry,always -S open -S close -S read -S write -S link -S unlink -S chmod -S chown -S execve -F uid=root -k root_activity If you do a man on auditctl it can show the options. You could, for example, generate a rule whenever a particular user launches firefox, etc..