best practices on user accounts

[NDO]

Hi All!

I am facing with a problem of tracking user activity, but its becoming a bit difficult, because, user´s logon onto the systems with the username of the application. Let´s say if in the server there ar an application called "LHS", the users logon with a username "lhs". This is how the application vendor set it up!

So the question is, how to track user activity? who did what?

Looking for your help, this is becoming a problem, because no one want to take responsability.

FR

[Dennis Handly · Accepted solution]

The last(1) command tracks logons and the source IP.  If these are relatively fixed, you can track the PC.

[NDO]

yes I used last -R, but I thought that I could track whoever did something from its userame

[Dennis Handly]

>I could track whoever did something from its username

No, that just tracks the source and login/logoff times.

If all users are running the same application, then unless you turn on system auditing, you would have to change the application to log the details.

[NDO]

ok thanks,