Solved

How can I log user action?

Posted on 1998-06-19
5
250 Views
Last Modified: 2013-12-27
I am running Solaris 2.5.1 and would like to log all user action.  For example, I would like to know what commands users have done, files changed by them, etc - even where they have been, if possible. Can this be done?  

Thanks,

racy
0
Comment
Question by:racy
  • 3
  • 2
5 Comments
 
LVL 2

Accepted Solution

by:
gormenghast earned 100 total points
ID: 2008099
Hi
If you are running accounting you can use commands such as:
lastcomm --> displays all commands executed (by user and TTY)
acctcom  --> ditto
acctcms  --> displays all commands executed (by time of day)

last         --> shows all login activity

If you want to monitor user activity completely you could even activate the script command in their login files to put all their login activity to a file. This will show everything a user does in their shell.
script [option] [file]
-a append script to file.
The default filename for script is typescript. I doubt if it would be necessary to resort to this sort of measure long term, and you would have to manage the files generated somehow.
0
 

Author Comment

by:racy
ID: 2008100
I think this may be what I want...how can I tell if I have accounting and/or turn it on...?


0
 
LVL 2

Expert Comment

by:gormenghast
ID: 2008101
Hi
Under Solaris accounting is off by default on a new system.
To start accounting at boot you need to create an entry in /etc/rc2.d or /etc/rc3.d by linking the file /etc/init.d/acct to /etc/rc2.d/S22acct.
This file executes the command /bin/su - adm -c /usr/lib/acct/startup
Create a shutdown entry by linking the same file to /etc/rc0.d/K22.acct.
This file executes the command /usr/lib/acct/shutacct.

You will then need to set up various crons for the various accounting utilities and to control the accounting file sizes. (Beware these can become quite large, there is also a small overhead on system performance when using accounting).

You really need to read up a bit on accounting before continuing, the answerbooks are probably a good place to start.
0
 

Author Comment

by:racy
ID: 2008102
Thanks again..perfect explanation.  Just one more question, and I'll leave you alone.  Where can I get these 'answerbooks'?  Solaris seems to have a lack of published books.  
0
 
LVL 2

Expert Comment

by:gormenghast
ID: 2008103
Hi
Answerbooks are electronic books supplied with Solaris.
You should find a pack of CDs which came with Solaris and one of these should contain the answerbooks. The one you will be most interested in is the System Administration answerbook. Once installed answerbooks are launched from the Programs menu in openwindows, this launches a gui which lists all installed answerbooks and has search facilities etc.
Get back to me anytime, or email me snorman@pavilion.co.uk
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Hello fellow BSD lovers, I've created a patch process for patching openjdk6 for BSD (FreeBSD specifically), although I tried to keep all BSD versions in mind when creating my patch. Welcome to OpenJDK6 on BSD First let me start with a little …
A metadevice consists of one or more devices (slices). It can be expanded by adding slices. Then, it can be grown to fill a larger space while the file system is in use. However, not all UNIX file systems (UFS) can be expanded this way. The conca…
Learn how to find files with the shell using the find and locate commands. Use locate to find a needle in a haystack.: With locate, check if the file still exists.: Use find to get the actual location of the file.:
In a previous video, we went over how to export a DynamoDB table into Amazon S3.  In this video, we show how to load the export from S3 into a DynamoDB table.

867 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now