psacct process accounting misses some commands

[Mark McDonald_2]

Hi

I need to enable some sort of process accounting to track what users are doing.

I am testing psacct, but it does not seem to log all commands.

for example, I just ran:
"echo hacker:x:66:666: etc" >> /etc/passwd

there is no sign of the echo command in lastcomm.

where would I expect this sort of command to show up?

Also there are some application shell scripts that also need ot be recorded. can I get these to be reported via lastcomm?

Thanks
Mark

[Matti_Kurkela]

The bash shell has several internal commands, "echo" is one of them. The shell can execute internal commands without starting a new process, so the process accounting system never sees them.

To track what happens inside the shell, you will need auditing at the system call and/or filesystem level. With such an audit subsystem properly configured, you would see an audit log message which would contain information like "at , process 6666 executing "bash" by user , group attempted to open /etc/passwd for writing, and was/was not successful". Many Linux distributions have such an audit subsystem included in their package collection.

Starting a shell script will normally cause a new process to be started, so it is usually possible to see it in process accounting logs.

But the accounting records are written only after the process ends, and only record the last command executed by that process: you could run a harmful program, then have it exec an innocuous program without forking a new process. As I understand, the accounting record would then count the resource usage of both programs, but only identify the innocuous one.

The accounting system in Unix was originally designed more for billing users according to their resource usage, not for tracking each step of what they're doing.

MK