you might have some luck using the bsd accounting system
(man acct for a start on the process). this logs each command
run along with the CPU time used.
Although it doesn't log command paramaters, you might be able to
hack it to do so. -- if so, then please pass on the patches (probably
to the linux-kernel group).
You might also be able to use the selinux logging capabilities to
achieve what you want. Once Selinux is enabled, you should be
able to use it to prevent disabling of logging.
Glynn Clements wrote:
Casper Helenius wrote:
I need to log every root activity on my Gentoo server, running syslog-ng.
I need to log logins (and, if possible, logouts) both by root or by
users SUDO'ing. I need to log which commands are executed as well as
their parameters.
The only way to achieve the last part is to log the raw connection
with e.g. ttysnoop. Even then, there are way to get around it (e.g.
upload a program and run that; unless you log all of the ways a
program can be uploaded, you won't know what they're actually
running).
Process accounting (CONFIG_BSD_PROCESS_ACCT) will log which programs
are run, but not their arguments or inputs.
Finally, anyone with unrestricted root privilege can disable or
otherwise interfere with logging. And if you're keeping the log files
locally (rather than using a separate logging server or a printer),
they can edit them.
-
: send the line "unsubscribe linux-admin" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
