Monitoring Execution of Commands at the prompt

[Jorge E Castro]

How can I monitor what commands the users on my system execute and know exactly what is going on at any time?

Right now I am using the .sh_history file on my users' home directories to see what they execute. This file is good, but there are times when users delete or change rights to certain directories and I can not find anything in the .sh_history files. I would like to know if there is any other way to capture this type of information.

Thanks, Jose

[RAC_1 · Accepted solution]

script command. Through /etc/profile execute this and put output to somewhere only you have access. Monitor that file with tail -f.

This gives whatever is happening on user's screen. But bware the files gow very fast.

Hope this helps.

[Helen French]

I would recommend enabling Accounting on the system for more reliable information. Check the man pages:

# man acct
# man 1m acct

And also at docs.hp.com

[Sridhar Bhaskarla]

Hi,

script is the command. But you cannot redirect the output file to a location to which root only has access for the ordinary user.

As long as I know you will need to have a software like CA eTrust which can control the access to the output file.

You can enable accounting. It can show all the base commands (for ex., if a user did a cd /somewhere, cd will be logged). You can get a report on all the commands etc., This is the simplest of all.

The otherway is to enable 'auditing' and audit only certain users. Look at man 5 audit and the relavent commands.

-Sri

[Jorge E Castro]

I would like to thank all of you that took the time to reply to my message, you guys have provided me with very good ideas and information.

Thanks, Jose