I tried to log the commands issued by the system administrators in our organization and its output using sudo plus the log_output directive as follows on the visudo file
Defaults env_reset
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
Defaults:%sudo log_output
...
root ALL=(ALL) ALL
...
%sudo ALL=(ALL) ALL
This does exactly what it is requested but it has a big flaw.
When the system administrators execute sudo su - the sudo file handler buffers the command output until the sudo session is closed, so the administrator can close the terminal and the commands output is never logged.
Also, we tried auditd but it does not who switched to root in the first place.
Is there a known way to force sudo flush the log files? Please let me know if it is a better software to log root activities that we may have overlooked.
Thanks!