cgy99,
Keeping track of system chnges is a problem in some environments, especially when historically people have had unrestricted access to the super user account for some time -- it's difficult to change that kind of culture and restrict access to the root account but I think you should consider habing a go.
For the moment though, Jon is quite right. The two things you can do are:
1. Monitor the file [tt]
/var/adm/sulog[/tt].
2. Use the [tt]
last[/tt] command ('[tt]
last root'[/tt]') to track some of the things done as root.
You should be aware that [tt]
last[/tt] is not exactly perfect for this. It will, for instance, pick up the fact that someone has run [tt]
vi[/tt] but will not tell you which files were edited....
For the future.
Have you though of putting it to management that unrestricted access to the root account will almost certainly result in time being wasted correcting errors? (and maybe worse)
Best situation is that only a couple of people have access to the root account (a techie and a manager who can give out the password if there's an emergency) but this is sometimes difficult to achieve.
If people have a genuine need to do some root work then there's a widely used utility you might be interested in called [tt]
sudo[/tt]. It allows access to certain commands for certain users.
Mike
michael.j.lacey@ntlworld.com
