how to capture useradd/userdel activities in syslog?

[jh_yang]

how to capture useradd/userdel activities in syslog?

Assuming user login as root on console directly and perform useradd/userdel there.


Thanks
David

[Emil Velez]

do it in sam/SMH and it is captured in the samlog and smh log

dont do it from the command line.

[Kapil Jha]

Probably you may try

user.debug and user.info

Options in syslog.conf(1M)

BR,
Kapil+

[V. Nyga]

Hi,

if a user logged in as root he always can prevent you from capture the activities.
You can write the activities in a log or history file, but root can always change such files.

But of course, you can try it.
You can configure history for root and define a big number for the history file, so you can grep history or the history file.
You also can create an alias for a command you like to capture and write the actifity in a log file before you execute the command.

HTH
V.