topic Re: trace root's activity in Operating System - Linux

trace root's activity

Lalo_Weng — Tue, 10 Dec 2002 08:15:14 GMT

Hello, All masters,

I want to trace all the activities root has peformed on my Hp-ux system. How can it do this? Are there any machnism in Hpux that can record the actions taken by root?

Thanks in advance.

Re: trace root's activity

U.SivaKumar_2 — Tue, 10 Dec 2002 10:36:34 GMT

Hi,

Without anybody's knowledge put this entry in root's .profile file.

script /tmp/.activ.log

Then if next time root login whatever command he types will be logged in to the file /tmp/.activ.log which can be read online
by this command.

tail -f /tmp/.activ.log

regards,
U.SivaKumar

Re: trace root's activity

Ian Vaughan — Tue, 10 Dec 2002 15:23:17 GMT

Howdy,
if you want to have a look at what root has done recently & root's actions are already logged why not try:
$ more $HISTFILE
whilst logged in as root

If you want to log what root has done how about
HISTFILE=/etc/security/rootlogs/log.$(date +"%y%m%d").$(logname).$$

You will have to make the security/rootlogs dir under /etc

If you force people to "su" to root rather than log in directly this will also tell you *who* executed the commend as the $(logname) will pick up their original id.

If I was suspicious of what root was doing and I had the authority I would change the password before something went badly wrong.

There is built in auditing in hp-ux (hey, I thought I was in the linux forum?) but that is probably overkill for what you want.
HTH
Ian

Re: trace root's activity

John Meissner — Wed, 11 Dec 2002 18:57:07 GMT

I would follow U.SivaKumar's advice with one small exception.

i would edit the .profile and put a better entry in:

script /tmp/`logname`.`date`.log

this way you know who su'd to root and what date and time they did this at