Monitoring Users

[Jose Luis]

Thank's everybody for your help. I did know about .history file, but is there some smarter application with dates, time and user command?
Thank's

[Tony Romero]

Jose,

The only other command I can think of is fc. For instance, you could su to a user's acct and do an fc -l and that would show you the commands that user has executed. Or you could set your system as a trusted system and audit certain users and functions.

[Arockia Jegan]

Hi,

If you want to monitor only some special accounts (like root) you can install sudo software on your system. Don't give the password of the special accounts to any one. But configure the sudoer file to give require access to them when they use sudo.

When they use sudo to run the commands it will keep all the records (including time, date, action... etc).

Else turn on the auditing..

[Craig Rants · Accepted solution]

The thing about monitoring commands is that command names can be changed, so don't think of that as truly exact accounting. Anyway you can monitor commands with system accounting, started in /sbin/init.d/acct (read up on it first), and monitor system calls with trusted computing base acccounting.

GL,
C

[Martin Johnson]

If you are not using account at this time, make sure you read up on it before you start it up. If you are not careful, you can easily fill up the file system where the log file resides.

HTH
Marty

[MANOJ SRIVASTAVA]

Hi Jose


It depends on waht level you plan to caputer the details ,

1. Like for loggin in we have no direct logins to roo and oracle and apps annd people ahve to log in as theire users and then su to the users , hence we caputer logs like that.

2.ofcouse as you say .sh_history.

3. You can enable process accounting , and this will create huge log files as to which use ran which command from waht terminal a detailed information can be got from this .

You ca do a man acct , and the commnad is /usr/sbin/acct/acctcom


Manoj Srivastava