AIX

create a directory which is write-only (read is disallowed) and put the history-files there. Thus the shell process will be able to write the history, but the users won't be able to read it.

bakunin

Right, so I've done the following but it's not working how I want.

I've created a folder, /etc/security/.history/ and given it write permissions only (chmod 222). This is owned by root / system.

I've added the following to the /etc/profile

___________________________________________
HISTSIZE=10000
WHO2=`w | awk '(\$2=="'$TTY'"){print \$1}'`
HISTFILE=/etc/security/.history/.history.${WHO2}.$(date +%Y%m%d.%H%M%S).$$.${LOGNAME}

export HISTSIZE WHO2 HISTFILE
___________________________________________

It is only creating files for root, not Oracle etc.
___________________________________________
root@cet_sup:/etc/security/.history> ls -lrt
total 24
-rw------- 1 root system 362 04 Apr 15:41 .history..20080404.153019.2072606.root
-rw------- 1 root system 60 04 Apr 15:42 .history..20080404.154204.2072606.root
-rw------- 1 root system 200 04 Apr 15:59 .history..20080404.154313.5693542.root
____________________________________________

How can I get it to work for other users??

have you tried "audit" command.

the best way to audit is to immediately transfer the audit to another server because if disaster happened your audit is also nowhere to find, then I'll introduce "snare auditting". It's an open source but if you buy the management, it's the same as commercial product, the trick is to create your own management and reporting system. Transfer all logs to a database, it can be an open source database so that you don't have to pay for it too.