Solaris

Is there a command to find out all the commands ran by a certain user id?

TiA

You would need to have process accounting enabled to do this.

Have a look at the documentation for acct.

Thanks. I'm not sure what what accounting is... but I just grepped the syslog for the username. Not exactly the quickest way but it worked. I'll have to research the other thing.

We have turned on accounting to track user commands and there is a lot of overhead.. but it meets requirements.
If you have the capability to keep the user from updating their login parameters, you can force the history for only that person via a login profile.

for example, force the login to ksh and then use the set -o emacs command
this will put all the commands they execute into their .sh_history file. Which you can then view.

If you can login as root then do the following steps:

# su - <unix-id>

where <unix-id> is the unix user id of that particular user you want to find out. Then type

# history

You can be able to see what commands he typed when he last logged in


Otherwise go to the user's home directory and look into history files which are usually hidden. They might be .sh_history, .bash_history etc....


com2com

Yes, this functionality is provided in Solaris auditing. You can check out this page on how to enable and configure it, and this on how to setup auditing of shell activity.