Todd Tannenbaum wrote: > So if users are typing away > at shell prompts (in an xterm window or whatever), no problem. Sure, those are probably captured by pty atime checks anyway. > But what is a user is just clicking with a mouse for 30 minutes in firebird... > seems like there would be no pty/tty activity, so I wonder if the atimes > on any ttyX files would change. If it's _purely_ mouse activity, no atimes are updated. > Ditto for if a user was typing up a > long message in a "pure" X11 window, like a Thunderbird message compose > window In testing, I found that any keyboard event results in an atime update, regardless of whether the event was captured by an xterm, a Thunderbird message window, a Firefox URL bar, or simply a modifier-key captured by the window manager. It's simple to test to see whether it works for yourself: * In one terminal, run `watch -n0 stat /dev/ttyN` (where N is the the TTY managed by your session, probably '7' -- check with `w` output.) * Whilst watching the atime field in the terminal, experiment with different classes of keyboard input.. > With non-USB keyboard, Condor would catch that activity by atime changes > on /dev/keyboard and /dev/mouse, but atimes do not change with USB > devices on an unpatched kernel.... Indeed, only keyboard input (USB or otherwise), not pointer device input, can be monitored using this technique. Though pointer device monitoring would also be desirable, just having keyboard input detection appears to be sufficient in practice. Cheers, David -- David McBride <dwm@xxxxxxxxxxxx> Department of Computing, Imperial College, London
Attachment:
signature.asc
Description: OpenPGP digital signature