Monitor root commands issued by users

Question

I tried to log the commands issued by the system administrators in our organization and its output using sudo plus the log_output directive as follows on the visudo file

Defaults        env_reset
Defaults            secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
Defaults:%sudo log_output

...
root    ALL=(ALL) ALL

...
%sudo ALL=(ALL)  ALL

This does exactly what it is requested but it has a big flaw.

When the system administrators execute sudo su - the sudo file handler buffers the command output until the sudo session is closed, so the administrator can close the terminal and the commands output is never logged.

Also, we tried auditd but it does not who switched to root in the first place.

Is there a known way to force sudo flush the log files? Please let me know if it is a better software to log root activities that we may have overlooked.

Thanks!

Answer 1

Sudosh may be a better solution. It logs sessions as needed and gives you "VCR" capabilities allowing you to replay sessions, its also available in most major distribution package repositories.

Answer 2

sudo 1.8.20 or higher has an iolog_flush setting that can be enabled.