This question already has an answer here:
I'm looking for a way to track our sysmin work, in the servers. Lets say sysmin 1 and sysmin 2 have access to any server but we need to make sure and track anything that they do in our server.
server 1 ---- auditd or history>syslog---| server 2 ---- auditd or history>syslog------- somthing like log.ly or saas server 3 ---- auditd or history>syslog---|
Is there any SaaS doing something like this? How do you monitor your friends or sysmin that are working so we could get something like this in a central location:
server 1, on 24-12-2013 12:42:32 user root command : ls server 1, on 24-12-2013 12:42:32 user root command : cd /home server 2, on 24-12-2013 12:42:32 user example command : ls
I known services like papertrailapp but they only have syslog that doesn't track bash command of users.