?
Solved

How can I log user action?

Posted on 1998-06-19
5
Medium Priority
?
259 Views
Last Modified: 2013-12-27
I am running Solaris 2.5.1 and would like to log all user action.  For example, I would like to know what commands users have done, files changed by them, etc - even where they have been, if possible. Can this be done?  

Thanks,

racy
0
Comment
Question by:racy
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
5 Comments
 
LVL 2

Accepted Solution

by:
gormenghast earned 400 total points
ID: 2008099
Hi
If you are running accounting you can use commands such as:
lastcomm --> displays all commands executed (by user and TTY)
acctcom  --> ditto
acctcms  --> displays all commands executed (by time of day)

last         --> shows all login activity

If you want to monitor user activity completely you could even activate the script command in their login files to put all their login activity to a file. This will show everything a user does in their shell.
script [option] [file]
-a append script to file.
The default filename for script is typescript. I doubt if it would be necessary to resort to this sort of measure long term, and you would have to manage the files generated somehow.
0
 

Author Comment

by:racy
ID: 2008100
I think this may be what I want...how can I tell if I have accounting and/or turn it on...?


0
 
LVL 2

Expert Comment

by:gormenghast
ID: 2008101
Hi
Under Solaris accounting is off by default on a new system.
To start accounting at boot you need to create an entry in /etc/rc2.d or /etc/rc3.d by linking the file /etc/init.d/acct to /etc/rc2.d/S22acct.
This file executes the command /bin/su - adm -c /usr/lib/acct/startup
Create a shutdown entry by linking the same file to /etc/rc0.d/K22.acct.
This file executes the command /usr/lib/acct/shutacct.

You will then need to set up various crons for the various accounting utilities and to control the accounting file sizes. (Beware these can become quite large, there is also a small overhead on system performance when using accounting).

You really need to read up a bit on accounting before continuing, the answerbooks are probably a good place to start.
0
 

Author Comment

by:racy
ID: 2008102
Thanks again..perfect explanation.  Just one more question, and I'll leave you alone.  Where can I get these 'answerbooks'?  Solaris seems to have a lack of published books.  
0
 
LVL 2

Expert Comment

by:gormenghast
ID: 2008103
Hi
Answerbooks are electronic books supplied with Solaris.
You should find a pack of CDs which came with Solaris and one of these should contain the answerbooks. The one you will be most interested in is the System Administration answerbook. Once installed answerbooks are launched from the Programs menu in openwindows, this launches a gui which lists all installed answerbooks and has search facilities etc.
Get back to me anytime, or email me snorman@pavilion.co.uk
0

Featured Post

On Demand Webinar - Networking for the Cloud Era

This webinar discusses:
-Common barriers companies experience when moving to the cloud
-How SD-WAN changes the way we look at networks
-Best practices customers should employ moving forward with cloud migration
-What happens behind the scenes of SteelConnect’s one-click button

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I promised to write further about my project, and here I am.  First, I needed to setup the Primary Server.  You can read how in this article: Setup FreeBSD Server with full HDD encryption (http://www.experts-exchange.com/OS/Unix/BSD/FreeBSD/A_3660-S…
Using libpcap/Jpcap to capture and send packets on Solaris version (10/11) Library used: 1.      Libpcap (http://www.tcpdump.org) Version 1.2 2.      Jpcap(http://netresearch.ics.uci.edu/kfujii/Jpcap/doc/index.html) Version 0.6 Prerequisite: 1.      GCC …
Learn several ways to interact with files and get file information from the bash shell. ls lists the contents of a directory: Using the -a flag displays hidden files: Using the -l flag formats the output in a long list: The file command gives us mor…
Learn how to navigate the file tree with the shell. Use pwd to print the current working directory: Use ls to list a directory's contents: Use cd to change to a new directory: Use wildcards instead of typing out long directory names: Use ../ to move…
Suggested Courses

777 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question