Re: How to log all commands?

From: Jani Mikkonen (jani_at_mikkonen.org)
Date: 05/31/05 

Date: Tue, 31 May 2005 14:06:35 +0300

Nekromancer wrote:

> How can I log all commands (including parameters) typed at any of the
> virtual terminals in a Linux server? The log must include time/date/user
> as well.

So many replys and none of them point to the process accounting. Linux
kernel has had p.a. since 1.3.* and should cover your ass even when user
finds a way to disable logging of his/her shell.

Check the man pages for accton, accton and ac and lastcomm..

On fedora/redhat these should be in package called psacct.

There's also howto on process accounting on linux howto mirrors..

Relevant Pages

  • Re: Which process are waiting for I/O?
    ... >I've got a box which is getting high loads as process are starting waiting ... You need to enable process accounting using accton: ... plan on leaving process accounting enabled after your troubleshooting. ...
    (freebsd-questions)
  • Re: Utility to assess which process is doing disk I/O
    ... >> but have a distinct feeling that we were talking Linux ... ... > But does Slowlaris give you per-process dio accounting? ... Afaik not, Solaris 9 speaking. ... and generally most of the process accounting done in the ...
    (Debian-User)
  • Re: performance hit from process accounting
    ... accton /var/account/pacct ... what process collects performance data and writes to the pacct file? ... I assume I can use process accounting to monitor err process accounting!? ...
    (alt.os.linux)
  • Re: Auditing
    ... >> process accounting on steroids, the kernel can record what has been done, ... &c. nothing is yet available for linux that is anywhere near it. ...
    (comp.os.linux.security)
  • performance hit from process accounting
    ... accton /var/account/pacct ... what process collects performance data and writes to the pacct file? ... I assume I can use process accounting to monitor err process accounting!? ...
    (alt.os.linux)