"acct" Exercise 1. Install acct $ sudo apt-get install acct Installed tools are : lastcomm ac sa 2. Now try them out Logins $ last Last command detail $ sudo lastcomm pts/0 User connect time $ ac -p or $ ac -d for per day. Previously executed command summary $ sudo sa 3501 255.96re 0.22cp 0avio 4922k 80 5.46re 0.20cp 0avio 32336k php 12 0.02re 0.00cp 0avio 2806k find 29 0.31re 0.00cp 0avio 2526k ***other* 40 2.27re 0.00cp 0avio 22320k rrdtool 80 number of times command was called 5.46re real time in wall clock minutes 0.20cp sum of system and user time in cpu minutes 32336k cpu-time averaged core usage, in 1k units 0avio average number of I/O operations per execution "php" command name Try: $ sudo sa -u $ sudo sa -m 3. Contemplate output from commands See the output and maybe pipe via "head" or "less". This is a lot of data. Are there other ways to detect access? Use "man" pages to get more info.