user activity

[Ron Irving]

Hello guru's!

My question may in fact be a simple one:

Is there a way to track users by login? Meaning, (especially root,) how do I generate some sort of user audit report/trail.

Thank you for reading my words!!

[Patrick Wallek · Accepted solution]

>>Is there a way to track users by login?

Track how? What information do you want?

The 'last' command will show you login/logout information for users. If you do 'last root' it will show the information for the root user.

>>Meaning, (especially root,) how do I
>>generate some sort of user audit
>>report/trail.

What kind of report? Do you want a log of all commands run?

[Jannik]

Logins
------
last

Failed Logins
-------------
lastb

Audit trail
-----------
tail -f /homedir/.sh_history

You could force your root users to use sudo. Sudo monitor all activities.

[Ron Irving]

I think I found it!!

sulog

Thank you for your prompt reply though.

[Ron Irving]

I used the 'last' command, and the /var/adm/sulog command.

Thank you!!