I tried to log the commands issued by the system administrators in our organization and its output using sudo plus the log_output directive as follows on the visudo file

Defaults        env_reset
Defaults            secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
Defaults:%sudo log_output

root    ALL=(ALL) ALL

%sudo ALL=(ALL)  ALL

This does exactly what it is requested but it has a big flaw.

When the system administrators execute sudo su - the sudo file handler buffers the command output until the sudo session is closed, so the administrator can close the terminal and the commands output is never logged.

Also, we tried auditd but it does not who switched to root in the first place.

Is there a known way to force sudo flush the log files? Please let me know if it is a better software to log root activities that we may have overlooked.



Sudosh may be a better solution. It logs sessions as needed and gives you "VCR" capabilities allowing you to replay sessions, its also available in most major distribution package repositories.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.