[CentOS] Linux User Auditing

On 9/3/07, Mag Gam <magawake at gmail.com> wrote:
> Bazy:
>
> Thanks. I hope in the future version of auditd, it will be much easier to
> monitor user's activities.
>
>

You can also run psacct which will also do other auditing commands.

yum install psacct
chkconfig --level 2345 psacct on
lastcomm

which will tell user commands BUT will not tell arguments and such.
aureport and its associated commands will tell you more but you need
to also load up a ruleset like CAPP or LSPP to get more info.

-- 
Stephen J Smoogen. -- CSIRT/Linux System Administrator
How far that little candle throws his beams! So shines a good deed
in a naughty world. = Shakespeare. "The Merchant of Venice"