Log Activity of user that sudo-ed/su-ed to root

Solution Verified - Updated -

Issue

  • What is the best way or best tool to log root access and commands. So in case if a user logs in as them selves then does a "sudo su -" or "sudo -i"
  • How to track what user is doing, so something that would tell us userX logged in then ran the command "sudo su -" and be able to tie the root commands back to the user.

Environment

  • Red Hat Enterprise Linux 6
  • psacct

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content