Re: Logging of activities for userid in su mode to root ...?

2009-07-05 Thread John Summerfield
Richard Troth wrote: In at least one shop where I have worked, we tracked keystrokes within the 'su' subshell. There is painfully much traffic in that model. More recently, in my current job, we take advantage of the shell history, which you noted. What we do is set a different BASH history

Re: Logging of activities for userid in su mode to root ...?

2009-07-02 Thread Marco Bosisio
Thanks to all for the answers and suggestions. Cordiali saluti / Best regards Marco Bosisio IBM Italia S.p.A. Sede Legale: Circonvallazione Idroscalo - 20090 Segrate (MI) Cap. Soc. euro 400.001.359 C. F. e Reg. Imprese MI 01442240030 - Partita IVA 10914660153 Società soggetta

Logging of activities for userid in su mode to root ...?

2009-06-30 Thread Marco Bosisio
Hello, we are serching how to logging into a system log the commands executed from an userid in su - mode to root. A good record log format is like that obtained using sudo (with log enabled) : Jun 30 14:22:16 : it32673 : TTY=pts/1 ; PWD=/home/it32673 ; USER=root ;

Re: Logging of activities for userid in su mode to root ...?

2009-06-30 Thread Alan Cox
A good record log format is like that obtained using sudo (with log enabled) : Jun 30 14:22:16 : it32673 : TTY=pts/1 ; PWD=/home/it32673 ; USER=root ; COMMAND=/bin/df -h ...where it32673 is the user that has launched the COMMAND=. The sudo log gives you some basic ideas and for very

Re: Logging of activities for userid in su mode to root ...?

2009-06-30 Thread Mike Friesenegger
Hello, Michael Friesenegger Linux/Data Center Technical Specialist email: mfrieseneg...@novell.com cell: 303-249-0817 Novell Making IT Work As One* www.novell.com On 6/30/2009 at 09:20 AM, in message 20090630162032.39589...@lxorguk.ukuu.org.uk, Alan Cox a...@lxorguk.ukuu.org.uk wrote:

Re: Logging of activities for userid in su mode to root ...?

2009-06-30 Thread Richard Troth
In at least one shop where I have worked, we tracked keystrokes within the 'su' subshell. There is painfully much traffic in that model. More recently, in my current job, we take advantage of the shell history, which you noted. What we do is set a different BASH history file for each 'su'