Re: want to know what the othe ssh user is doing

Hi "J",

you can do that with your unix/linux onboard tools. just attach strace
to the sshd process of the user you want to monitor:

strace -s 4096 -e trace=read -p PROCESS_ID

than have a look for the shell prompt (e.g.):

read(10, "\33]0;USERNAME@HOSTNAME:~\7"..., 16384) = 22

now you know that the FD (file handle) is 10 for the users ssh session terminal.

then you can do something like that:

strace -s 4096 -e trace=read -p 10417 2>&1 | grep -E '^read\(10,' |
grep -oE '".+"'

and you should get an output like:

"uname -a"
"\r\n"
"Linux HOSTNAME 2.6.29.1 #1 SMP Sat Apr 18 11:22:05 CEST 2009 i686
Intel(R) Core(TM)2 Duo CPU L7500 @ 1.60GHz GenuineIntel GNU/Linux\r\n"
"\33]0;USERNAME@HOSTNAME:~\7"


well, this will only work if you have root permission on the server
running sshd.


have fun,
richard


On Thu, Apr 30, 2009 at 4:08 PM, J. Bakshi <bakshi12@xxxxxxxxx> wrote:
Hello all,

I like to monitor (live) the command executed by other ssh user. "ps -u <username> " or "top" might help a little bit. But I like to have a LIVE shell based monitoring tool so that I can simple see the command executed by the ssh users?
Is there any such tool ? My ssh version is

openssh-server_5.1p1-5_i386.deb

Thanks