Shell Programming and Scripting

Hi guys,
i am not on solaris, i am on red hat ..
How can i do such detailed audit on red hat ?
Such auditing that would enable me to see what commands did userA executed
when i was logged with userA in winscp..

Unfortunately there is no equivalent tool on Red Hat or any version of GNU/Linux that I am aware of.

if i do summarize issue

1-) determine the settings

let know default settings is in

Code:

# cat /etc/auditd.conf

and you can change or specialize this to man auditd.conf
you can leave any change too if you wish

2-) write rules

you must set up watch rules by auditctl (man auditctl for details)
watch myfolder for read write execution for id user with 500 --> UserA

Code:

# auditctl -w /myfolder/ -p rwx -F auid=500

and we save this rules in audit.rules for permanent

Code:

 
# vi /etc/audit.rules
.....
.....
-w /myfolder/ -p rwxa -F auid=500

-w --> watch path
-p --> permission (rwxa , read write , executive , attribute change )
-F auid --> watch this user
...
...

3-) start service

Code:

# service auditd start

4-) check results
and for log analysis i can advice below app

seaudit
Using seaudit for Audit Log Analysis
or
auditviewer
https://fedorahosted.org/audit-viewe...iewerDownloads


Regards
ygemici