Monitoring kill execution

[David_711]

I want monitoring the execution of kill command and save the information in a log file. I want monitoring; uid, date, and process that is killed.

Somebody have a script or program that can helpme.

Thanks a lot

David

[RAC_1]

The following is the old post of yours. The ways mentioned in the thread can help you.

Anil

[A. Clay Stephenson]

First of all, kill is a shell built-in so that in order to make this work (good luck) you would have to ensure that all your users alias kill to use /usr/bin/kill --- and that said alias remains in place (again, good luck). A regular user cannot kill (more properly, signal) a process outside his process group -- only a privilged user can do that. Any priviliged user can easily hide their tracks by editing/removing any log files. Rather than writting a wrapper for /usr/bin/kill, I would write a C substitute but it's still far from foolproof.

This is a case where what is really needed is not a utility but discipline and education.

[David_711]

Rac,
That is true, but not work.
The script not log nothing.

Thanks
David

[David_711]

Hi again.
One question more. I activate the trusted mode in my hpux 11.11 for log only kill command. There is installed sybase and cobis,
But when the service is started the file.log of my kill command register processes killed by sybase.
How do i can do for only log the kill command executed by only the users and not by sybase.
I activated the modes sucessfull and failed kill; and succesfull only separately, but the result is the same.

Any help
Thanks
David

[RAC_1]

You can use audusr to audit particular users.
man audusr for details.

Anil