application and user logging

[Peter Scott]

At 01:28 PM 6/20/01 -0700, Russ Allbery wrote:
> > More specifically, we intend in our University campus to check whether
> > some programs are used or not, in order to re-organize our purchasing
> > policy. Therefore, we are looking for a cross-plattform solution (Unices,
> > Windows) to monitor the use of AFS, both in terms of users ticketing and
> > applications use as well, while a further plan is to show the results on
> > the web in real time.
>
>I have a Unix-only solution that involves wrappering all the binaries
>whose usage you want to track so that rather than running the actual
>binary, the user first runs a small C program that sends a UDP packet to a
>tracking host and then execs the real binary.  It's not robust in the face
>of users trying to intentionally bypass it, but it works pretty well
>otherwise.

We are considering monitoring based upon the count of number of volume 
accesses within the last day.  Not totally accurate perhaps, but seems as 
though the noise should not swamp the signal.  And since we're using depot, 
every tool for every platform has it own volume.

Has anyone successfully used this approach?  Or proved it fruitless?

>I have no idea if the same thing would work for Windows, since I know very
>little about Windows and am interested in knowing less,

I know *exactly* what you mean...

--
Peter Scott
Peter.J.Scott@jpl.nasa.gov