Wnat to record all the activitys done by any user

[FOIS CRIS]

I want to record all the activities done by any user on UNIX. Kindly send the the script to perform this action. I want to record all the commands and their output.

[Arunvijai_4]

Hello,

You need to export HISTFILE in user's .profile. Just like,

export HISTFILE=$HOME/.sh_history.

It should be enough.,

-Arun

[Senthil Kumar .A_1]

Hi fois,

Collecting the commands issued might be wise but not its output, as the log can grow too huge.

So if indeed u are bent upon capturing the output aswell, make sure u include the following line at the end of .profile file in all home directories,

script -a /var/collect/${LOGNAME}_collect

Then u need to write the script to purge the files in /var/collect/ directory and archive it, as it could be really huge.

/var/collect was just a example used here.

One problem is the users could simply delete the last entry in .profile if they find that they are being spied, better u could make .profile readonly.


A enterprise soultion is available , called CA's autosecure or e-trust, but again it only logs commands used not its output. It is a advanced counter part of central user administration like nis.

anyway, and offbeat implementaion should work , without spilling much of dollors..

regards,
senthil.

P.S: please wait for others aswell to respond.

[Vibhor Kumar Agarwal]

If you want to track only the command you can have the history file.

If you want the output also then you can use the "script" command.
This will redirect everything to the file you give.

[Muthukumar_5]

Few ways:

1) Enabling History:


In /etc/profile file as,

export HISTFILE=$HOME/.profile_${USERNAME}
export HISTSIZE=2500

and save it. You can check the history based on the user name.

More better create a separate directory for history and change the location of HISTFILE to this directory say (history) instead of their HOME directory.

--
Muthu

[Muthukumar_5]

More ways as,

in /etc/profile,

start a script file in append mode as,

script -a /history/histfile_${USERNAME}

Note: Create a history file and give enough permission to all users to log the informations into /history directory.

Another way,

to convert your system to trusted mode to log all the things. (Auditing)

--
Muthu

[Arunvijai_4]

Hello,

Check these threads,

http://forums1.itrc.hp.com/service/forums/bizsupport/questionanswer.do?threadId=14568
http://forums1.itrc.hp.com/service/forums/bizsupport/questionanswer.do?threadId=127593

-Arun

[Yogeeraj_1]

hi,
also have a look at tripwire.

see also: http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=876110

hope this helps!

kind regards
yogeeraj