Log Activity of user that sudo-ed/su-ed to root
Issue
- What is the best way or best tool to log root access and commands. So in case if a user logs in as them selves then does a "sudo su -" or "sudo -i"
- How to track what user is doing, so something that would tell us userX logged in then ran the command "sudo su -" and be able to tie the root commands back to the user.
Environment
- Red Hat Enterprise Linux 6
- psacct
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.