Solved

How can I log user action?

Posted on 1998-06-19
5
248 Views
Last Modified: 2013-12-27
I am running Solaris 2.5.1 and would like to log all user action.  For example, I would like to know what commands users have done, files changed by them, etc - even where they have been, if possible. Can this be done?  

Thanks,

racy
0
Comment
Question by:racy
  • 3
  • 2
5 Comments
 
LVL 2

Accepted Solution

by:
gormenghast earned 100 total points
Comment Utility
Hi
If you are running accounting you can use commands such as:
lastcomm --> displays all commands executed (by user and TTY)
acctcom  --> ditto
acctcms  --> displays all commands executed (by time of day)

last         --> shows all login activity

If you want to monitor user activity completely you could even activate the script command in their login files to put all their login activity to a file. This will show everything a user does in their shell.
script [option] [file]
-a append script to file.
The default filename for script is typescript. I doubt if it would be necessary to resort to this sort of measure long term, and you would have to manage the files generated somehow.
0
 

Author Comment

by:racy
Comment Utility
I think this may be what I want...how can I tell if I have accounting and/or turn it on...?


0
 
LVL 2

Expert Comment

by:gormenghast
Comment Utility
Hi
Under Solaris accounting is off by default on a new system.
To start accounting at boot you need to create an entry in /etc/rc2.d or /etc/rc3.d by linking the file /etc/init.d/acct to /etc/rc2.d/S22acct.
This file executes the command /bin/su - adm -c /usr/lib/acct/startup
Create a shutdown entry by linking the same file to /etc/rc0.d/K22.acct.
This file executes the command /usr/lib/acct/shutacct.

You will then need to set up various crons for the various accounting utilities and to control the accounting file sizes. (Beware these can become quite large, there is also a small overhead on system performance when using accounting).

You really need to read up a bit on accounting before continuing, the answerbooks are probably a good place to start.
0
 

Author Comment

by:racy
Comment Utility
Thanks again..perfect explanation.  Just one more question, and I'll leave you alone.  Where can I get these 'answerbooks'?  Solaris seems to have a lack of published books.  
0
 
LVL 2

Expert Comment

by:gormenghast
Comment Utility
Hi
Answerbooks are electronic books supplied with Solaris.
You should find a pack of CDs which came with Solaris and one of these should contain the answerbooks. The one you will be most interested in is the System Administration answerbook. Once installed answerbooks are launched from the Programs menu in openwindows, this launches a gui which lists all installed answerbooks and has search facilities etc.
Get back to me anytime, or email me snorman@pavilion.co.uk
0

Featured Post

IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

In tuning file systems on the Solaris Operating System, changing some parameters of a file system usually destroys the data on it. For instance, changing the cache segment block size in the volume of a T3 requires that you delete the existing volu…
My previous tech tip, Installing the Solaris OS From the Flash Archive On a Tape (http://www.experts-exchange.com/articles/OS/Unix/Solaris/Installing-the-Solaris-OS-From-the-Flash-Archive-on-a-Tape.html), discussed installing the Solaris Operating S…
Learn several ways to interact with files and get file information from the bash shell. ls lists the contents of a directory: Using the -a flag displays hidden files: Using the -l flag formats the output in a long list: The file command gives us mor…
Learn how to navigate the file tree with the shell. Use pwd to print the current working directory: Use ls to list a directory's contents: Use cd to change to a new directory: Use wildcards instead of typing out long directory names: Use ../ to move…

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now