Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

I'm looking for a way to track our sysmin work, in the servers. Lets say sysmin 1 and sysmin 2 have access to any server but we need to make sure and track anything that they do in our server.

Something like:

server 1 ---- auditd or history>syslog---| 
server 2 ---- auditd or history>syslog------- somthing like or saas 
server 3 ---- auditd or history>syslog---|

Is there any SaaS doing something like this? How do you monitor your friends or sysmin that are working so we could get something like this in a central location:

server 1, on 24-12-2013 12:42:32 user root command : ls
server 1, on 24-12-2013 12:42:32 user root command : cd /home
server 2, on 24-12-2013 12:42:32 user example command : ls

I known services like papertrailapp but they only have syslog that doesn't track bash command of users.

share|improve this question

marked as duplicate by sciurus, Jenny D, cole, MadHatter, Dave M Nov 20 '13 at 16:15

This question was marked as an exact duplicate of an existing question.

See… – sciurus Nov 20 '13 at 1:33

One solution is to force sudo access for all commands. Users log in as themselves and then use sudo to do their activity. If you setup a centralized syslog server you can then monitor all the sudoers entries.

Of course, prickly sysadmins like me will login as themselves and then sudo -i giving a non-logged shell for all subsequent commands. If you want to remove that possibility, you probably need to do so with a written policy rather than a technical solution. Could be tricky to enforce/get buy-in for.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.