Hey, OSSEC itself is not capable of logging commands after sudo'ing to root or similar. Actually it is not meant for logging itself but for log analysis. It only creates logs for the HIDS itself and alerts generated. Even with process monitoring, OSSEC itself does not create the output but runs a command and treats the output as a log. To achieve what you are looking for, you would need to find a mechanism that allows for recording all commands executed by root (either general or after gaining uid=0 after executing sudo -s or su root).
Here are some links about this topic: http://etbe.coker.com.au/2010/06/11/logging-shell-commands/ http://sourceforge.net/projects/snoopylogger/ http://www.unix.com/security/85932-how-do-i-find-all-commands-entered-root-any-terminal.html http://www.linuxquestions.org/questions/showthread.php?p=4063262#post4063262 http://www.issociate.de/board/post/289444/Logging_root_activity_with_syslog-ng.html Let me know if you find something suitable. Kind regards, Oscar On Aug 17, 12:23 am, jplee3 <[email protected]> wrote: > Hi all, > > Just wondering if OSSEC has the ability to capture all commands run > after sudo'ing or su'ing to root (or another privileged user, etc). > > TIA!
