Tracking of user login sessions

1. A system comprising:

a processor configured to:

determine that a first user login session and a second user login session have a parent-child relationship that indicates that a particular user is associated with both the first and second user login sessions; and

link first user login activity performed during the first user login session and second user login activity performed during the second user login session to the user; and

a memory coupled to the processor and configured to provide the processor with instructions;

wherein the determining that the first user login session and the second user login session have the parent-child relationship includes matching a pair of ssh connection records occurring within a first time period, wherein a first member of a matched pair corresponds to a source of a connection and wherein a second member of the matched pair corresponds to a destination of the connection.

2. The system of claim 1 , wherein:

the processor is further configured to receive first information associated with the first user login activity and second information associated with the second user login activity; and

the determining is based on the first information and the second information.

3. The system of claim 2 , wherein the first information and the second information are received, respectively, from a first agent on a first host and a second agent on a second host.

4. The system of claim 3 , wherein the first host and second host are different.

5. The system of claim 3 , wherein the first host and second host are the same.

6. The system of claim 2 , wherein the first information is obtained in response to identifying one or more ssh connection records occurring within a first time period.

7. The system of claim 1 , wherein the determining that the first user login session and second user login session have the parent-child relationship further includes matching an additional pair of ssh connection records in which a first member of an additional matched pair occurs within a first time period and wherein a second member of the matched pair occurs outside the first time period.

8. The system of claim 1 , wherein the determining that the first user login session and the second user login session have the parent-child relationship further includes matching an additional pair of ssh connection records, and wherein, in response to a determination that multiple matches are possible, a pair having a smallest delta between respective start times is selected.

9. The system of claim 1 , wherein the determining that the first user login session and the second user login session have the parent-child relationship includes matching a pair of ssh connection records using a GUID included by a client in a connection request.

10. The system of claim 1 , wherein the linking the first user login activity and the second user login activity includes joining an ssh connection record and a new login record.

11. The system of claim 1 , wherein the processor is further configured to identify an original login session associated with a subsequent chain of login sessions.

12. The system of claim 11 , wherein at least one of the first login session and the second login session is included in the subsequent chain of login sessions.

13. The system of claim 11 , wherein the processor is configured to identify the original login session at least in part by using an ssh lineage table.

14. The system of claim 11 , wherein the original login session occurs on a first machine and wherein at least one session included in the subsequent chain of login sessions occurs on a second machine that is different from the first machine.

15. The system of claim 11 , wherein the processor is configured to identify the original login session by recursively determining adjacency relationships between login sessions.

16. The system of claim 1 , wherein the linking the first user login activity and the second user login activity includes associating a process to a child process using a process hierarchy.

17. A method comprising:

determining that a first user login session and a second user login session have a parent-child relationship that indicates that a particular user is associated with both the first and second user login sessions; and

linking first user login activity performed during the first user login session and second user login activity performed during the second user login session to the user;

wherein the determining that the first user login session and the second user login session have the parent-child relationship includes matching a pair of ssh connection records occurring within a first time period, wherein a first member of a matched pair corresponds to a source of a connection and wherein a second member of the matched pair corresponds to a destination of the connection.

18. The method of claim 17 , further comprising:

receiving first information associated with the first user login activity and second information associated with the second user login activity;

wherein the determining is based on the first information and the second information.

19. A computer program product stored on a non-transitory medium and comprising computer instructions for:

determining that a first user login session and a second user login session have a parent-child relationship that indicates that a particular user is associated with both the first and second user login sessions; and

linking first user login activity performed during the first user login session and second user login activity performed during the second user login session to the user;

wherein the determining that the first user login session and the second user login session have the parent-child relationship includes matching a pair of ssh connection records occurring within a first time period, wherein a first member of a matched pair corresponds to a source of a connection and wherein a second member of the matched pair corresponds to a destination of the connection.