[ossec-list] Re: User auditing solution

[Mark Smith]

Navid,

We're using kernel-level auditing coupled with the following rule to log all
commands run

        -a entry,always -S execve

Take a look at the auditd manpage and see if that's more what you were
after.

Regards,

--
Mark Smith