• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 269
  • Last Modified:

How can I log user action?

I am running Solaris 2.5.1 and would like to log all user action.  For example, I would like to know what commands users have done, files changed by them, etc - even where they have been, if possible. Can this be done?  

Thanks,

racy
0
racy
Asked:
racy
  • 3
  • 2
1 Solution
 
gormenghastCommented:
Hi
If you are running accounting you can use commands such as:
lastcomm --> displays all commands executed (by user and TTY)
acctcom  --> ditto
acctcms  --> displays all commands executed (by time of day)

last         --> shows all login activity

If you want to monitor user activity completely you could even activate the script command in their login files to put all their login activity to a file. This will show everything a user does in their shell.
script [option] [file]
-a append script to file.
The default filename for script is typescript. I doubt if it would be necessary to resort to this sort of measure long term, and you would have to manage the files generated somehow.
0
 
racyAuthor Commented:
I think this may be what I want...how can I tell if I have accounting and/or turn it on...?


0
 
gormenghastCommented:
Hi
Under Solaris accounting is off by default on a new system.
To start accounting at boot you need to create an entry in /etc/rc2.d or /etc/rc3.d by linking the file /etc/init.d/acct to /etc/rc2.d/S22acct.
This file executes the command /bin/su - adm -c /usr/lib/acct/startup
Create a shutdown entry by linking the same file to /etc/rc0.d/K22.acct.
This file executes the command /usr/lib/acct/shutacct.

You will then need to set up various crons for the various accounting utilities and to control the accounting file sizes. (Beware these can become quite large, there is also a small overhead on system performance when using accounting).

You really need to read up a bit on accounting before continuing, the answerbooks are probably a good place to start.
0
 
racyAuthor Commented:
Thanks again..perfect explanation.  Just one more question, and I'll leave you alone.  Where can I get these 'answerbooks'?  Solaris seems to have a lack of published books.  
0
 
gormenghastCommented:
Hi
Answerbooks are electronic books supplied with Solaris.
You should find a pack of CDs which came with Solaris and one of these should contain the answerbooks. The one you will be most interested in is the System Administration answerbook. Once installed answerbooks are launched from the Programs menu in openwindows, this launches a gui which lists all installed answerbooks and has search facilities etc.
Get back to me anytime, or email me snorman@pavilion.co.uk
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Cloud Class® Course: CompTIA Healthcare IT Tech

This course will help prep you to earn the CompTIA Healthcare IT Technician certification showing that you have the knowledge and skills needed to succeed in installing, managing, and troubleshooting IT systems in medical and clinical settings.

  • 3
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now