how to monitor all accounts run all commands from login to present?

BRAHmS · 08-19-2004, 08:18 AM

as above

TheOther1 · 08-19-2004, 09:00 AM

So you want to see what each user has done? You can parse the .bash_history file... But it will only show you command line stuff. There are other history files specific to some apps also. As root,

Code:

locate history | less

or for a specific user:

Code:

locate history | grep user_name | less

and replace user_name with the user name.

If you are trying to find out if someone has done a su -, you can parse the /var/log/messages file(s). You will see something like this:

Code:

Aug 19 09:38:03 machinename su(pam_unix)[4095]: session opened for user root by (uid=500)

jlliagre · 08-19-2004, 01:56 PM

You can also use a Solaris 10 dtrace background script that create a log of all execs for all users so you are sure not to miss any subcommand or command run from historyless shells.

BRAHmS · 08-20-2004, 09:50 AM

Quote:

Originally posted by jlliagre
You can also use a Solaris 10 dtrace background script that create a log of all execs for all users so you are sure not to miss any subcommand or command run from historyless shells.

but my solaris os is 8

how to do?

jlliagre · 08-20-2004, 12:00 PM

Upgrade to 10

Otherwise, here is something to start that should work with solaris 8:

Code:

truss -adf -s!all -t exec,fork -p 1 $(pgrep inetd) $(pgrep sshd)

You would need some post processing to match commands to users though.