Monitor what your users do

[hfaix]

Does anyone monitor everything a specific user does? I've been asked to look into this for SOX404. I know I could probably pull it off with AIX audit ( but I don't really like audit), and I can also use the .sh_history file (with limitations). However, it seems like a better solution should exist.

What do you do ?

 

[DSMARWAY]

hi ,
it depends whether the users have access to the shell and perform various manual tasks , or whether they log into the application directly in which case does the application log what the users do ?

if you are concerned about security then it may be worth taking a deeper look at what services should be running on the server , whether to use SSH rather than telnet , whether to disable rlogin commands etc..

HTH

 

[hfaix]

I'm not concerned about security (SSH vs Telnet/ftp). I've just been asked what's the best way to monitor everything a "dba type" of account does once it's logged into. With Sarbases Ox 404 breathing down our backs, an admin really should provide a log of activies these users do while implementing their change control process of moving new program/script/database from test to production on a system critical to finacial statements. I can do it with audit, I thought i'd see what others do. Thanks for the response though.