Interesting, if a user can modify the history file, you can't see what's been done. I honestly thought this was something pretty basic for security and wanted to add this in all my nodes for a single history file. Mike > You can do this through syslog but it would require > you to modify the kernel code and recompile it. You > would basically printk() all exec's in the kernel. > Otherwise the honeynet project would probably be the > best people to ask about this. -- Linux-cluster mailing list Linux-cluster@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/linux-cluster