topic Re: Monitoring Users in Operating System - HP-UX

Monitoring Users

Jose Luis — Wed, 26 Jun 2002 16:11:02 GMT

Thank's everybody for your help. I did know about .history file, but is there some smarter application with dates, time and user command?
Thank's

Re: Monitoring Users

Tony Romero — Wed, 26 Jun 2002 16:25:00 GMT

Jose,

The only other command I can think of is fc. For instance, you could su to a user's acct and do an fc -l and that would show you the commands that user has executed. Or you could set your system as a trusted system and audit certain users and functions.

Re: Monitoring Users

Arockia Jegan — Wed, 26 Jun 2002 16:40:50 GMT

Hi,

If you want to monitor only some special accounts (like root) you can install sudo software on your system. Don't give the password of the special accounts to any one. But configure the sudoer file to give require access to them when they use sudo.

When they use sudo to run the commands it will keep all the records (including time, date, action... etc).

Else turn on the auditing..

Re: Monitoring Users

Craig Rants — Wed, 26 Jun 2002 16:44:37 GMT

The thing about monitoring commands is that command names can be changed, so don't think of that as truly exact accounting. Anyway you can monitor commands with system accounting, started in /sbin/init.d/acct (read up on it first), and monitor system calls with trusted computing base acccounting.

GL,
C

Re: Monitoring Users

Martin Johnson — Wed, 26 Jun 2002 16:57:10 GMT

If you are not using account at this time, make sure you read up on it before you start it up. If you are not careful, you can easily fill up the file system where the log file resides.

HTH
Marty

Re: Monitoring Users

MANOJ SRIVASTAVA — Wed, 26 Jun 2002 17:02:09 GMT

Hi Jose

It depends on waht level you plan to caputer the details ,

1. Like for loggin in we have no direct logins to roo and oracle and apps annd people ahve to log in as theire users and then su to the users , hence we caputer logs like that.

2.ofcouse as you say .sh_history.

3. You can enable process accounting , and this will create huge log files as to which use ran which command from waht terminal a detailed information can be got from this .

You ca do a man acct , and the commnad is /usr/sbin/acct/acctcom

Manoj Srivastava