UNIX Shell Logging

[Johnny2009]

Hi,

Can someone recommend a product that would allow me to log details of users shell sessions? A bit like an expanded .sh_history file with timestamps for each command, & also details of commands entered in sessions with databases & other tools launched from the shell.

TIA

Johnny

[Suraj K Sankari]

Hi,

Enable auditing into your server...

Suraj

[Ganesan R]

Hi Jhonny,

Then you should go for auditing enabled.

Refer these links for more details

http://docs.hp.com/en/5992-3387/ch10.html

http://docs.hp.com/en/B2355-90121/index.html

[Steven E. Protter]

Shalom Johnny,

I would go with auditing for the server as recommended above.

I will however explain why.

.sh_history is a wonderful file, but in order to log peoples actions they need read-write permission to the files.

This means they can alter the contents.

Auditing collects data in a file that only root can access. Therefore a user trying to cover their tracks or mistake can not.

SEP

[Mel Burslan]

If you are looking for an enterprise level solution with logging to remote server, where even the root user does not have direct access to, unlike auditing, I'd suggest using PowerBroker from symark software.

[Johnny2009]

Thanks for the response guys. Appreciate it.

[Olivier Masse]

Some places force everyone to run root commands using RBAC or sudo. But that's very intrusive, I don't like that solution.

Something more transparent consists of using the auditing subsystem to log most exec() calls and you would have the equivalent of what you're looking for, i.e. a timestamp, a command, and a username.

If on the other hand you want to log complete interactive sessions, meaning you would like to be able to playback what users did on their terminal and see what they saw, there is something now that does this and it's better than using script(1). I saw at HPTF2009 (in a non-NDA session) that HP developped such a tool, but I'm was not able to download Ron's slides so I don't know if it's available yet and what it's called.

Good luck

[Johnny2009]

OK - so I have started the auditing system taking mostly deault parameters, but dis extend the list of events within the /etc/rc.config.d/auditing
AUDEVENT_ARGS1="P -e login -e admin -e delete -e modaccess -e open"

I then logged into the sysetem via telnet, touched a file, vi the file, the rm the file, then logged out.

Yet, when I then view the audit trial using audisp , I only see my login, but no other activity.

I thought that the event list provided within the AUDEVENT_ARGS1 list would have captured all my events?

any ideas where I have gone wrong on this one?

thanks
Johnny