Is there any method to log vi activities? I suspect that another user is issuing command by going into the shell inside the vi editor, apparently those command doesn't record into history.
You can also turn on process accounting ( s/can/should/ !)
You can then use:
to see the command run and if they were run after a fork, with or without an exec.
Combined with a host based IDS this should give you what you need "that the King's justice may be done upon him."
How are you logging their activities right now? The easiest is to block them from launching shells from vi.
If you're using a special shell to log their commands, you could change vi to use that shell only.
Are you talking about the shell history? vi shell mode (
that will ensure that every user command gets logged to a file, it doesn't get overwritten, and it gets updated every time the shell prompt appears.
Note that users can override this in their personal
Some versions of vi (like nvi) support a safe mode that disables shell access, via starting vi as
Note that in general the issue of users getting to the shell via unexpected means is a classic unix problem. There's no way to disable this completely, the best you can do is try to limit the access by default. A sophisticated user (or even a user who knows how to use google) can always get around these restrictions. For example if a user doesn't want his shell history logged he could always just exec a new copy of the shell with whatever options he wanted to use.
Here's a great writeup of how to force logging in bash and the ways that logging can be circumvented.
Finally, have you considered just talking to the user to determine what they are doing? 99% of the time simple verbal communication can clear up any confusion. If you are logging this user's activity because you don't trust them, maybe you can talk to them about your concerns.