We use shared accounts on our servers. Each uses a different ssh key. Is there a way to create an audit trail of who ran what commands? We can distinguish real "users" by the ssh key used.
I don't see a way to do it in one place, but if you're willing to trudge through the logs you can get SSHD to log the key fingerprint when someone logs in:
And then log the commands:
Notice in the comments there's a note about getting this to work on ubuntu.
You can then connect the session ID found in the system logs to the command logs through ausearch:
In the end, if you can separate the accounts (and manage permissions based on a group?) that might simplify things for you.