9.38. Monitoring All Executed Commands
Problem
You want to record information about executed commands, a.k.a., process accounting.
Solution
Prepare to enable process accounting:
# umask 077 Be sure that the accounting data isn't publicly readable # touch /var/account/pacct Create the log file if necessary
Enable it:
# accton /var/account/pacct
or:
# /etc/init.d/psacct start Red Hat # /etc/init.d/acct start SuSE
or:
# service psacct start Red Hat
To disable it:
# accton Note: no filename
or:
# /etc/init.d/psacct stop Red Hat # /etc/init.d/acct stop SuSE
or:
# service psacct stop Red Hat
To enable process accounting automatically at boot time:
# chkconfig psacct on Red Hat # chkconfig acct on SuSE
By default, the process accounting RPM is not installed for Red Hat 8.0 or SuSE 8.0, but both distributions include it. The package name is psacct for Red Hat, and acct for SuSE.
Discussion
Sometimes, investigating suspicious activity requires time travel—you need detailed information about what happened during some interval in the past. Process accounting can help.
The Linux kernel can record a wealth of information about processes as they exit. This feature originally was designed to support charging for resources such as CPU time (hence the name “process accounting”), but today it is used mostly as an audit trail for detective work.
The accton command enables process accounting, and specifies the file used for the audit trail, conventionally /var/account/pacct . This file must already exist, so manually ...
Get Linux Security Cookbook now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.