12-02-2008 02:00 AM
The PasTmon passive traffic monitor keeps an eye on your network, recording which clients are interacting with which services, when and how long things took. You can then use the application's PHP Web interface to investigate these figures to see if any host is connecting to Web services that it shouldn't, or is contacting services suspiciously more frequently than you would expect for normal operation, or when response times become excessively long.
I am responsible for administering 6 Tru64UX servers.
I need to keep an eye on all the commands executed by all the users.
Is there a way where I can save the commands executed in a seperate folder and then keep checking the list every now and then.
How can do it ? (5 Replies)
niffconfig(8) System Manager's Manual niffconfig(8)NAME
niffconfig - Configuration program for the Network Interface Failure Finder (NIFF)
SYNOPSIS
/usr/sbin/niffconfig [-a] [-m] [-r] [-s] [-u] [-v] [-d num] [-o num] [-t num] [interface1 interface2...]
OPTIONS
Adds an interface or interfaces, specified by the interface parameter. You cannot specify the -a option with the -m, -s, -r, or -u options.
Specifies the time period, in seconds, that the traffic monitor thread uses between reads of the interface counters when it suspects there
is a connectivity problem. This number must be smaller than the number given for the -t option. The default time period is 5 seconds. If
num is not specified, niffconfig uses the default. Specifies the total number of traffic-free seconds that must elapse before the traffic
monitor thread determines that a network interface has failed. This number must be at least the sum of the -d option and two times the -t
option. That is, given the default time period for -d and -t, the -o option must be at least 20 seconds. The default time period for this
option is 60 seconds. If num is not specified, niffconfig uses the default. Modifies the timing parameters of an interface that is already
being monitored. Typically, this option is specified along with one or more of -t num, -d num, or -o num options. If none of these parame-
ters are specified, the default value is used. You cannot specify the -m option with the -a, -s, -r, or -u options. Stops monitoring the
specified interface. Obtains the status of the specified interface. Specifies the time period, in seconds, that the traffic monitor
thread delays between reads of the interface counters when the network is running normally. The default time period is 20 seconds. If num
is not specified, niffconfig uses the default. Displays the status of all interfaces currently being monitored to standard out (stdout).
Displays the status, timer values, and description (verbose mode) of all interfaces currently being monitored to standard out (stdout).
DESCRIPTION
The niffconfig command arranges for one or more network interfaces to be monitored for possible loss of connectivity. Timing parameters
that govern how quickly an interface can be declared suspect or dead may be manipulated with this command. You can specify multiple inter-
faces, separated by a space, on the command line. Note, you must be superuser to use the niffconfig command.
Except for the -u and -u options, all niffconfig options require one or more network interfaces to be specified.
EXAMPLES
To add the tu0 and tu1 interfaces to the list of monitored interfaces, enter: # niffconfig -a tu0 tu1 To change the time it takes to
declare failure on the tu1 interface to 90 seconds, enter: # niffconfig -o 90 tu1 To display the status of all interfaces that are being
monitored: # niffconfig -u To stop monitoring the tu0 interface: # niffconfig -r tu0
SEE ALSO
Daemons: niffd(8)
Information: EVM(5), nifftmt(7)niffconfig(8)