Audience: Moodle Server Admins with CL access

Take Away: Why would a Moodle Server Admin want to do this?
Let's see: bullying and inappropriate use of language ... the former gaining more and more media attention recently due to some unfortunate events in K12 schools … are two.
IMHO, best headed off as much as possible before any further developments.

Are you 'spying'?  Well, kinda, but students should know that anything they do on the Moodle system is tracked.  If that is of concern, might want to write up a 'privacy policy' in your Moodle dis-closing that all communication activities will be monitored.

Here's How:

logged on as root user, go to /usr/local/bin/
that directory and the scripts contained therein can be accessed/run from any location on the server while in a shell.

Use an editor, to write the script.

nano watchim [ENTER]

Copy and paste the following line in the 'watchim' script.

IF on Ubuntu server:

tail -f /var/log/apache2/access.log| fgrep 'message/refresh

IF on CentOS server:

tail -f /var/log/httpd/access_log |fgrep 'message/refresh'

Save the script: [CTRL][w] and exit [CTRL][x].

Change permissions on the script to make it executable by the root user:

chmod u+x watchim [ENTER]

Since you were logged on as the root user, only the root user may execute/run the script.

Try out your script.  Return to the root home directory:

cd ~ or cd /root

Then type the name of the script: watchim [ENTER]

You'll see references of Moodle user (A) sending an im to another Moodle user (B) - the date/time stamp and the IP address being used during the IM conversation.  It will NOT, however, disclose the contents of the messages themselves.  For that, there is a php script that one can install in the blocks directory of the Moodle.

This script can be turned into a Webmin button - Custom Commands.
It may not 'refresh', however.