vivek is remove many files. The command just showing “rm” command, So how could i know what did he remove ??????

Please help

I gone through the entire comments but nobody clearly spacifying..is there any tool for tracking the user executed commands and path of the file/folder.

Like [root@nisslave pravi]# pwd
/home/pravi
[root@nisslave pravi]# cat test
dfasdf
[root@nisslave pravi]#

Weird. Can you compile and run this program once as root and once as non-privileged user on your system? Source here:
http://source.a2o.si/tmp/snoopy/test-getuid.c

Compiled for Linux 32bit here:
http://source.a2o.si/tmp/snoopy/test-getuid

Post the results on sourceforge issue tracker please (in order not to bloat this blog post with irrelevant comments)
Tnx!

[fimz@localhost ~]$ sudo vim /etc/pam.d/sshd
[fimz@localhost ~]$ cat /etc/pam.d/sshd
#%PAM-1.0
auth include system-auth
account required pam_nologin.so
account include system-auth
password include system-auth
session optional pam_keyinit.so force revoke
session include system-auth
session required pam_loginuid.so
session required pam_tty_audit.so disable=* enable=*
[fimz@localhost ~]$ date
Wed Sep 23 11:29:16 NZST 2009
[fimz@localhost ~]$ sudo su -
[root@localhost ~]# service sshd restart
Stopping sshd: [ OK ]
Starting sshd: [ OK ]
login as: fimz
fimz@X.Y.2.3′s password:
Last login: Wed Sep 23 11:24:02 2009 from it029481.xyz.org
[fimz@localhost ~]$
[fimz@localhost ~]$ ls
Desktop
[fimz@localhost ~]$ ls -a
. .bashrc .gconfd .gtkrc-1.2-gnome2 .redhat
.. Desktop .gnome .ICEauthority .Trash
.bash_history .dmrc .gnome2 .metacity .viminfo
.bash_logout .eggcups .gnome2_private .mozilla
.bash_profile .gconf .gstreamer-0.10 .nautilus
[fimz@localhost ~]$ ls -l
total 8
drwxr-xr-x 2 fimz fimz 4096 Sep 10 16:02 Desktop
[fimz@localhost ~]$ mount
/dev/mapper/VolGroup00-LogVol00 on / type ext3 (rw)
proc on /proc type proc (rw)
sysfs on /sys type sysfs (rw)
devpts on /dev/pts type devpts (rw,gid=5,mode=620)
/dev/sda1 on /boot type ext3 (rw)
tmpfs on /dev/shm type tmpfs (rw)
none on /proc/sys/fs/binfmt_misc type binfmt_misc (rw)
sunrpc on /var/lib/nfs/rpc_pipefs type rpc_pipefs (rw)
[fimz@localhost ~]$ date
Wed Sep 23 11:31:05 NZST 2009

[fimz@localhost ~]$ sudo grep mount /var/log/*
/var/log/secure:Sep 23 11:31:56 localhost sudo: fimz : TTY=pts/1 ; PWD=/home/fimz ; USER=root ; COMMAND=/bin/grep mount /var/log/acpid /var/log/anaconda.log /var/log/anaconda.syslog /var/log/anaconda.xlog /var/log/audit /var/log/boot.log /var/log/boot.log.1 /var/log/boot.log.2 /var/log/btmp /var/log/conman /var/log/conman.old /var/log/cron /var/log/cron.1 /var/log/cron.2 /var/log/cups /var/log/dmesg /var/log/faillog /var/log/gdm /var/log/httpd /var/log/lastlog /var/log/mail /var/log/maillog /var/log/maillog.1 /var/log/maillog.2 /var/log/messages /var/log/messages.1 /var/log/messages.2 /var/log/news /var/log/pm /var/log/ppp /var/log/prelink /var/log/rpmpkgs /var/log/rpmpkgs.1 /var/log/rpmpkgs.2 /var/log/samba /var/log/scrollkeeper.log /var/log/secure /var/log/secure.1 /var/log/secure.2 /var/log/setroubleshoot /var/log/spooler /var/log/spooler.1 /var/log/spooler.2 /var/log/squid /var/log/tallylog /var/log/vbox /var/log/wtmp /var/log/Xorg.0.log /var/log/Xorg.0.log.old /var/log/yum.log

I was expecting it to log to messages, but apparently its not!

To the pam stack.

Thanks

This will produce a key by key typing of what was pressed inside the session. (including, up, down backspace, etc)

You can use ausearch to look through it.

I.E “ausearch -ts recent -m tty -i”

Im interested to know is there a way to log all keystrokes including typos & complete command parameters with this say $rm -rf /* or custom scripts such as $./foo 10.0.0.1
My requirement is to log *EVERYTHING* the command and its associated flags and parameters.

Thanks