History of commands run by user after logging into root

Asked Aug 13 '20 at 11:37

Active Aug 13 '20 at 11:44

Viewed 45 times

I have a requirement to audit all the commands run by a user after he logs into root. Can anyone please help me with it. (for Suse-Linux)

To explain even more simpler

user alex logs into the server with his username and password
switches to root user, runs few commands (I want to know what commands were run by Alex after switching into root user) if possible with timestamps

edited Aug 13 '20 at 11:44

Jeff Schaller

asked Aug 13 '20 at 11:37

Jay

3

What shell is alex running ? How does he runs priviledged commands su ? sudo ? sudo su... ? – MC68020 Aug 13 '20 at 11:51
@MC68020 bash shell – Jay Aug 13 '20 at 12:22
WRT to the duplicate, the accepted answer is not available in Suse where it is in Ubuntu however this answer should be compatible. – Philip Couling Aug 13 '20 at 13:52
@MC68020 Alex uses a bash shell and uses sudo su - to switch to root – Jay Aug 14 '20 at 10:02

0 Answers0