In the place I work, there are multiple users who log in to any server through ssh and perform various tasks. In general, they are supposed only to run commands on the servers, not copy files out of the servers. And yes, they have root access.
What I need to find out is, the amount of data transferred out of each server by a user. In other words, from the moment a user logins to the moment they disconnect, I need to find out the total data transferred i.e. sent as well as received, between their server and the ssh server. This might help in tracking users who might have transferred lots of sensitive data out of the servers. There are some huge files on the server.