I installed rootsh but when I run
sudo /usr/local/bin/rootsh
it logs everything as the username root, instead of the underprivliged user.

Jul 11 10:10:19 testsrv rootsh[063f4]: root: root=root,/dev/pts/0: logging new session (rootsh[063f4]) to /var/log/rootsh/root.20080711101019.063f4
Jul 11 10:10:23 testsrv rootsh[063f4]: root: 000: root@testsrv [/root/rootsh-1.5.3]# whoami
Jul 11 10:10:23 testsrv rootsh[063f4]: root: 001: root
Jul 11 10:10:24 testsrv rootsh[063f4]: root: 002: root@testsrv [/root/rootsh-1.5.3]# exit
Jul 11 10:10:24 testsrv rootsh[063f4]: root: 003: exit
Jul 11 10:10:24 testsrv rootsh[063f4]: root: 004: *** rootsh session ended by user
Jul 11 10:10:24 testsrv rootsh[063f4]: root: 005:
Jul 11 10:10:24 testsrv rootsh[063f4]: root: root,/dev/pts/0: closing rootsh session (rootsh[063f4])
Jul 11 10:11:29 testsrv rootsh[0640b]: root: root=root,/dev/pts/0: logging new session (rootsh[0640b]) to /var/log/rootsh/root.20080711101129

Also all the files in /var/log/rootsh/ start with root.
even those that is suppose to be the underprivliged username.

Any ideas why its doing that?

TIA!

Try this: login as unprivileged user, now issue 'sudo rootsh -u root'. Then type 'lsof -w -n -p $$'. On file descriptor 3 it should show a log in the output dir you configured with in the name of the file the unprivileged username. If it's not doing that, what does it show when you start rootsh without arguments or sudo as unprivileged user? And how did you install Rootsh? From source (which compile flags?) or as package (which one?).

Thanks, its working now, I had to login as the user, before, I was loggedin as root and then su'ed to my sudo user.

If I read your reply right, you *know* you shouldn't ever login as root account user in the first place! In any case, logging in as unprivileged user has the added benefit that you can run rootsh as their default shell. This means you not only get the audit trail when they sudo to another account but the trail for the regular user account as well. That's not only a good thing when you need to monitor allowed access by employees but also for say auditing third party access. Of course the AUP slash system banners should make clear the system is monitored.