Miguel Sanders wrote:
> Dear all
>
> I am setting up logging for incoming connections.
> However, I was wondering if it was also possible to track down the
> logouts.
> So at the moment, I know when user X logs in through SSH (in the logs)
> but I have no idea when he logs out.
> Can these events also be logged?
>
> Thank you.
>
I am not too sure, but I guess if it can be done for system-wide on
Linux platform, it can be done at /etc/inittab level (adding LoginHook
and LogoutHook) .

The other thing could be possibly add the hooks to system-wide shell rc
files present under /etc/ like profile|.bash_logout|.login but they are
shell dependent.

Another way perhaps could be to monitor /var/log/secure and wtmp file
and write up your own logout monitoring.

Nikhil