ps + acct

Lonnie Olson lists at kittypee.com
Wed Jul 30 11:22:10 MDT 2008


On Tue, Jul 29, 2008 at 11:44 AM, Daniel <teletautala at gmail.com> wrote:
> ps aux will show which processes is running with the parameters used.
> acct will log which command was executed.  I want a combination of the
> two to show which command was executed with what parameters as well as
> who ran it when and when it stopped.  I need this for a Fedora box and
> an Ubuntu box.

This will be difficult.  The accounting subsystem doesn't log anything
but the command names themselves.

You will need to implement something a little more hackish to get that
kind of logging.
Here are some options you may want to investigate:
* Force users to run commands which you want to log with sudo
* Write a wrapper script that users call which logs it's params and
calls the real command
* SELinux may give you logging abilities
* AppArmor may include some logging as well.

--lonnie



More information about the PLUG mailing list