This is not how you approach the problem. Once you give shell access to a user, you are entrusting that user to do anything he/she has the proper permissions to. Forget command logging, there are way too many ways to execute a command in any Unix system.
For example, the user may start a mail client (the only command logged is pine
, for example), in there he selects "Compose" which starts VI, and from VI he launches any command he wants through :!cmd
. This command isn't logged anywhere, and from the point-of-view of the system, it is like any helper application called by VI, like grep or sort. The only command logged by the shell was pine
.
It seems that what you actually want is called auditing. Enable the auditing subsystem and use the auditctl
command and the auditd
daemon from the audit package to control what is logged. More information is in the auditctl(8) manual page.
Note that logging every process instantiation it may also not be optimal. For example, the simple ./configure
for a software package (created using autotools) is notable for creating thousands of process instantiations. This will flood the auditing log with so much noise that it becomes very hard to analyze it later.