topic Re: Logging all activities for a telnet/ssh session in Operating System - HP-UX

Logging all activities for a telnet/ssh session

Brent Weaver_1 — Tue, 29 Mar 2011 21:03:48 GMT

I am looking for guidance on how to log any activity a user does when logged into my HPUX server. Tee is not really working as well as I would like for two reasons:

1 - The user can exit out of the tee session
2 - The CR LF are different making the session unusable.

I thought that I could use exec to trap the user in the tee session but that is not working. Will screen be able to help me in any way? Another important thing to mention is that I am not only operating in a UNIX shell, the users also dip in and out of a utility layer/database command line. Of course ~/.sh_history is incomplete as it does not log when they are in the database utility.

Any advice is appreciated.

Re: Logging all activities for a telnet/ssh session

Shibin_2 — Wed, 30 Mar 2011 03:10:13 GMT

You can't use sh_history to record the things in database. It's almost similar activity like, you jump from one host to another. When you jump from one host to another, you will be in another host and the history records on that host. You may have to consult with Database admin, whether any option to record those history. I think, there should be something.

Re: Logging all activities for a telnet/ssh session

Matti_Kurkela — Thu, 04 Aug 2011 16:54:10 GMT

You need something you can run in place of the user's shell to capture all the input/output in the session. The open-source utilities "sudosh" and "rootsh" could do that.

Please see my answer in another thread:

http://h30499.www3.hp.com/t5/System-Administration/Alternative-to-saving-history/m-p/4768198#M389626

Re: Logging all activities for a telnet/ssh session

Viktor Balogh — Wed, 30 Mar 2011 12:16:18 GMT

If you ask me, I would use rootsh. It logs the entire session, also the DB activity. The latest version ported to HP-UX is 1.5.2, which you can find here:

http://sourceforge.net/projects/rootsh/files/rootsh/1.5.2/