ps + acct
lists at kittypee.com
Wed Jul 30 11:22:10 MDT 2008
On Tue, Jul 29, 2008 at 11:44 AM, Daniel <teletautala at gmail.com> wrote:
> ps aux will show which processes is running with the parameters used.
> acct will log which command was executed. I want a combination of the
> two to show which command was executed with what parameters as well as
> who ran it when and when it stopped. I need this for a Fedora box and
> an Ubuntu box.
This will be difficult. The accounting subsystem doesn't log anything
but the command names themselves.
You will need to implement something a little more hackish to get that
kind of logging.
Here are some options you may want to investigate:
* Force users to run commands which you want to log with sudo
* Write a wrapper script that users call which logs it's params and
calls the real command
* SELinux may give you logging abilities
* AppArmor may include some logging as well.
More information about the PLUG