Re: How to log all commands?

nick4soup_at_yahoo.com.au
Date: 05/31/05

  • Next message: Menno Duursma: "Re: How to log all commands?" 
    Date: 31 May 2005 01:46:31 -0700

    Davide Bianchi wrote:
    > On 2005-05-30, Nekromancer <foo@bar.org> wrote:
    > > How can I log all commands (including parameters) typed at any of the
    > > virtual terminals in a Linux server?
    >
    > You could use process accounting, but already the commands are saved
    > in the .bash_history files for each user, so just preserving those
    > should give you a lot of information (a part for time and date).

    I find that .bash_history is not reliable. If I run two or three
    xterms, command histories for one or more of them tend to disappear.

    I have a similar question, but it's for a non-malicious user:

      want to log each command they use, along with their present working
    directory at the time, and the pty/tty the command came from. Helpful
    to have the date/time, too.

    They won't be executing subshells, turning off history, nulling it,
    etc.

    Nick Bishop
    -----
    email replies ignored
    -----
    Cambodian law: Water guns may not be used in New Year celebrations.
    -oOo-

  • Next message: Menno Duursma: "Re: How to log all commands?"

    Relevant Pages

    • Re: root shell auditing
      ... I've tried this, it lacks some detail if I remember correctly it doesn't log params as it was designed for process accounting, not security auditing, which could mean missing a lot as sometimes it's the parameters that make all the difference between a normal and a dangerous action. ... Developers use the command line too and often aren't anywhere near as smart or industry educated as they think they are which is why sometimes it's very handy if you can check on what they've done. ... If you make a mistake once, ok it's a typo, but he did the same thing the next day too so I had to tell him to be more careful, which I could since I had proof it was his fault (I had his cwd as well in this case to match against the relatives. ...
      (Focus-Linux)
    • Re: process accounting
      ... In the last episode, ... > process accounting. ... command to summarize them. ... See the lastcomm and sa manpages for more ...
      (freebsd-questions)