users auditing- require tool or Script

[vas_3]

Hi all,

We have small business requirement.Requirement is: we need to audit all the commands (user/root realted ) typed by the users(only 6 users) on all hp,linux and solaris servers.

If u have any script please share with me or you know any tool, send me the tool name..


Thanks in advance...
Regards,
Sri.

[Steven E. Protter]

Shalom,

Unix has a built in auditing tool. Keyboard history. It does not include a time/date stamp.

In the user profile.

HISTSIZE=5000
HISTFILE=.sh_history
export HISTSIZE HISTFILE

The log will be kept. Don't put the .sh_history file on NFS for HP-UX.

Linux uses .bash_history

I have no idea about Solaris.

SEP

[Dennis Handly]

Are your users working for or against you?

You could also use typescript(1) to log all input and output.

[rmueller58]

typescript is one what to do it as well.

I used typescript to monitor a vendor account to track what they did when they were on our systems.

on sun you would use

script

check out link here:
http://ultra.pr.erau.edu/~jaffem/classes/cs125/script.htm

[Rasheed Tamton]

Hi,

In HP-UX also it is script command:

script srifile (create a file called srifile and save everything printed on the user's screen into it)

script -a srifile (will append on the file)

The other way as SEP said, rely on history file. There are other tools like powerbroker, etc. which can playback (pbreplay) the logged sessions but needs to pay for that.

Regards.

[Dennis Handly]

>ME: You could also use typescript(1) to log all input and output.

Oops, the default output file is typescript and the command is script(1):
http://docs.hp.com/en/B2355-60130/script.1.html