topic Wnat to record all the activitys done by any user in Operating System - HP-UX

Wnat to record all the activitys done by any user

FOIS CRIS — Thu, 23 Feb 2006 04:11:51 GMT

I want to record all the activities done by any user on UNIX. Kindly send the the script to perform this action. I want to record all the commands and their output.

Re: Wnat to record all the activitys done by any user

Arunvijai_4 — Thu, 23 Feb 2006 04:16:57 GMT

Hello,

You need to export HISTFILE in user's .profile. Just like,

export HISTFILE=$HOME/.sh_history.

It should be enough.,

-Arun

Re: Wnat to record all the activitys done by any user

Senthil Kumar .A_1 — Thu, 23 Feb 2006 04:25:03 GMT

Hi fois,

Collecting the commands issued might be wise but not its output, as the log can grow too huge.

So if indeed u are bent upon capturing the output aswell, make sure u include the following line at the end of .profile file in all home directories,

script -a /var/collect/${LOGNAME}_collect

Then u need to write the script to purge the files in /var/collect/ directory and archive it, as it could be really huge.

/var/collect was just a example used here.

One problem is the users could simply delete the last entry in .profile if they find that they are being spied, better u could make .profile readonly.

A enterprise soultion is available , called CA's autosecure or e-trust, but again it only logs commands used not its output. It is a advanced counter part of central user administration like nis.

anyway, and offbeat implementaion should work , without spilling much of dollors..

regards,
senthil.

P.S: please wait for others aswell to respond.

Re: Wnat to record all the activitys done by any user

Vibhor Kumar Agarwal — Thu, 23 Feb 2006 04:31:48 GMT

If you want to track only the command you can have the history file.

If you want the output also then you can use the "script" command.
This will redirect everything to the file you give.

Re: Wnat to record all the activitys done by any user

Muthukumar_5 — Thu, 23 Feb 2006 04:33:59 GMT

Few ways:

1) Enabling History:

In /etc/profile file as,

export HISTFILE=$HOME/.profile_${USERNAME}
export HISTSIZE=2500

and save it. You can check the history based on the user name.

More better create a separate directory for history and change the location of HISTFILE to this directory say (history) instead of their HOME directory.

--
Muthu

Re: Wnat to record all the activitys done by any user

Muthukumar_5 — Thu, 23 Feb 2006 04:37:03 GMT

More ways as,

in /etc/profile,

start a script file in append mode as,

script -a /history/histfile_${USERNAME}

Note: Create a history file and give enough permission to all users to log the informations into /history directory.

Another way,

to convert your system to trusted mode to log all the things. (Auditing)

--
Muthu

Re: Wnat to record all the activitys done by any user

Arunvijai_4 — Thu, 23 Feb 2006 04:41:01 GMT

Hello,

Check these threads,

http://forums1.itrc.hp.com/service/forums/bizsupport/questionanswer.do?threadId=14568
http://forums1.itrc.hp.com/service/forums/bizsupport/questionanswer.do?threadId=127593

-Arun

Re: Wnat to record all the activitys done by any user

Yogeeraj_1 — Thu, 23 Feb 2006 06:03:24 GMT

hi,
also have a look at tripwire.

see also: http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=876110

hope this helps!

kind regards
yogeeraj