AIX

Is there a tool or application the will audit users activity? I've tryed to use audit the comes with AIX but to gathers so much information it is near impossible to see what they are doing. I just want to monitor logins and and files they create or change.

Well, if your users are dumb enough , you can just use the shell history: .history, .bash_history or something alike ... and may i suggest that best tool might be the one you write

You could also specify their history file in the /etc/profile with a few lines like these:

HISTSIZE=10000
mkdir -p $HOME/.history
HISTFILE=$HOME/.history/.history.$(date +%Y%m%d.%H%M%S).$$

This would keep 10,000 events in a uniquely named history files with the date they logged in included in the name of the file.

I have followed history files for the users I wish to track. The main problem is that when the su to another user My tracking stops because I have the script start in the .profile and end at logout. su doesn't use the .profile.

If you put the history setup in the /etc/profile, every user will have a .history file. When the user does a "su - aixuser", you can look in aixuser's .history file for continued tracking.

Here's something else you can do to track cross-user .history files:

HISTSIZE=10000
mkdir -p $HOME/.history
WHO2=`w | awk '(\$2=="'$TTY'"){print \$1}'`
HISTFILE=$HOME/.history/.history.${WHO2}.$(date +%Y%m%d.%H%M%S).$$.${LOGNAME}

The "WHO2" is set to the name of the user the person logged on to the box as. The "LOGNAME" is on every AIX machine (I think) and is set to the name of the user you are currently logged in as.

When your history files are created, they will contain your remote login name, the user you did a "su" to, and the date they were created. This makes for easier tracking.

Oh yeah... put those commands in the /etc/history file.

Only problem with that is that the user can see their own .history folder and delete the file, thus deleting the trace....

How can you combat that?