command logging

esdeedee · 05-23-2006, 08:37 AM

How can you configure command logging on linux (RedHat EL 4) for the root account?
The logging of our common users we log in sudolog. But system-administrators may become root (su).
Can we log their commands, they execute as root user (in messages or syslog or ...?)

marozsas · 05-23-2006, 09:24 AM

On RHEL3, the service psacct start logging of system accounting;
To enable it, just "service psacct start".
To get human readable data use the command "sa".

unSpawn · 05-24-2006, 12:29 PM

...and if psacct ain't enough have a look at rootsh, connect to remote syslog if necessary. Of course root can do stuff to thwart logging, so if rootsh ain't enough you could for instance look at the extended logging facilities the GRSecurity kernel patch provides.