Does not log anything. Does it work on RedHat7 ?

[jkodadala]

Installation works fine, the process starts fine but it just does not log anything. My OS version is Red Hat Enterprise Linux Server release 7.3 (Maipo)

Here is how my device file looks like. Looking at it, it looks like event1 is my device that should get captured and I am using this command 'logkeys --start -d /dev/input/event1 -u --output test.log'

cat /proc/bus/input/devices

I: Bus=0019 Vendor=0000 Product=0001 Version=0000 N: Name="Power Button" P: Phys=LNXPWRBN/button/input0 S: Sysfs=/devices/LNXSYSTM:00/LNXPWRBN:00/input/input0 U: Uniq= H: Handlers=kbd event0 B: PROP=0 B: EV=3 B: KEY=10000000000000 0

I: Bus=0011 Vendor=0001 Product=0001 Version=ab41 N: Name="AT Translated Set 2 keyboard" P: Phys=isa0060/serio0/input0 S: Sysfs=/devices/platform/i8042/serio0/input/input1 U: Uniq= H: Handlers=sysrq kbd event1 B: PROP=0 B: EV=120013 B: KEY=402000000 3803078f800d001 feffffdfffefffff fffffffffffffffe B: MSC=10 B: LED=7

I: Bus=0011 Vendor=0002 Product=0012 Version=0006 N: Name="VirtualPS/2 VMware VMMouse" P: Phys=isa0060/serio1/input1 S: Sysfs=/devices/platform/i8042/serio1/input/input2 U: Uniq= H: Handlers=mouse0 event2 B: PROP=0 B: EV=b B: KEY=70000 0 0 0 0 B: ABS=3

I: Bus=0011 Vendor=0002 Product=0012 Version=0006 N: Name="VirtualPS/2 VMware VMMouse" P: Phys=isa0060/serio1/input0 S: Sysfs=/devices/platform/i8042/serio1/input/input3 U: Uniq= H: Handlers=mouse1 event3 B: PROP=1 B: EV=7 B: KEY=30000 0 0 0 0 B: REL=103

I: Bus=0010 Vendor=001f Product=0001 Version=0100 N: Name="PC Speaker" P: Phys=isa0061/input0 S: Sysfs=/devices/platform/pcspkr/input/input4 U: Uniq= H: Handlers=kbd event4 B: PROP=0 B: EV=40001 B: SND=6

my locale --

locale LANG=en_US.UTF-8 LC_CTYPE="en_US.UTF-8" LC_NUMERIC="en_US.UTF-8" LC_TIME="en_US.UTF-8" LC_COLLATE="en_US.UTF-8" LC_MONETARY="en_US.UTF-8" LC_MESSAGES="en_US.UTF-8" LC_PAPER="en_US.UTF-8" LC_NAME="en_US.UTF-8" LC_ADDRESS="en_US.UTF-8" LC_TELEPHONE="en_US.UTF-8" LC_MEASUREMENT="en_US.UTF-8" LC_IDENTIFICATION="en_US.UTF-8" LC_ALL=en_US.UTF-8

Looking at the log file:

tail --follow test.log Logging started ...

2017-02-28 14:22:42-0700 >

Logging stopped at 2017-02-28 14:23:26-0700

Logging started ...

2017-02-28 14:25:15-0700 >

Logging stopped at 2017-02-28 14:44:04-0700

And it does not log anything.

[LightAutumnMelancholy]

Same issue is occuring on redhat 7+ here.

[kernc]

Also in a virtual machine? Does cat on the correct event device work?

[LightAutumnMelancholy]

I run mine as a virtual host, and this doesn't seem to work. I log in via ssh as the host is not local, but on one of my hypervisor hosts.

[jkodadala]

I am trying to get this working on RHEL7 VM.

Here are the list of my input event*

ls /dev/input/event* /dev/input/event0 /dev/input/event1 /dev/input/event2 /dev/input/event3 /dev/input/event4

From the looks of my /proc/bus/input/devices, looks like event1 is my device but when I try to cat the device and type something, it doesn't say anything back (I have tried with remaining devices and same results)

cat /dev/input/event1 asdf tsdg but why say something

^C

And I Control C out of it.

I am on a Mac, using a Mac keyboard connected via USB and ssh'd onto RHEL 7 VM.

Here is an interesting observation with this issue --

When I ssh to the VM from my local desktop (Mac), the logging does not work. When I log on the VM directly from the console (using vCenter interface), the logging works great.

Most of the users remote onto the VM than logging into VM using console and like to see this tool working when logged in remotely via ssh or any method.

[kernc]

Well, that's great to hear; logkeys only works with hardware-attached keyboards, so if anyone were typing on a keyboard directly connected to the RHEL machine, or on a keyboard VM simulates as a directly connected to the RHEL machine, cat wouldn't be silent and logkeys would (god be willing) log. Whereas keystrokes sent via a SSH session presumably don't pass through the kernel but are passed to remote shell process or X directly.

So there's little I can do but direct you to alternative solutions with which you might be able to record your SSH sessions: https://askubuntu.com/questions/112686/log-ssh-activity https://superuser.com/questions/679390/how-to-make-logkeys-work-over-ssh

[jkodadala]

Thanks Kernc for your response. I will look into the links you shared and will also explore other options.