Linux Security Cookbook

9.38. Monitoring All Executed Commands

Problem

You want to record information about executed commands, a.k.a., process accounting.

Solution

Prepare to enable process accounting:

# umask 077                                    Be sure that the accounting data isn't publicly readable
# touch /var/account/pacct                     Create the log file if necessary

Enable it:

# accton /var/account/pacct

or:

# /etc/init.d/psacct start     Red Hat
# /etc/init.d/acct start                       SuSE

or:

# service psacct start         Red Hat

To disable it:

# accton                       Note: no filename

or:

# /etc/init.d/psacct stop      Red Hat
# /etc/init.d/acct stop                        SuSE

or:

# service psacct stop          Red Hat

To enable process accounting automatically at boot time:

# chkconfig psacct on          Red Hat
# chkconfig acct on                            SuSE

By default, the process accounting RPM is not installed for Red Hat 8.0 or SuSE 8.0, but both distributions include it. The package name is psacct for Red Hat, and acct for SuSE.

Discussion

Sometimes, investigating suspicious activity requires time travel—you need detailed information about what happened during some interval in the past. Process accounting can help.

The Linux kernel can record a wealth of information about processes as they exit. This feature originally was designed to support charging for resources such as CPU time (hence the name “process accounting”), but today it is used mostly as an audit trail for detective work.

The accton command enables process accounting, and specifies the file used for the audit trail, conventionally /var/account/pacct . This file must already exist, so manually ...