What is the preferred method to keep track of who is acting as root in the logs when root login is disabled (SSH) but users can run
sudo -i or
su - to become root? I would like to follow every command with the original username as well. RHEL 6 or any Linux rsyslog, etc.
On Red Hat distros you typically use the
If you have cooperating users, you can setup rootsh to log everything the root user types to syslog.
rootsh rpms are available in EPEL.
The version of sudo on RHEL6 is also capable of logging stdout to a file for every sudo session. Look into the sudo_plugins man page.
Neither of these approaches is completely bulletproof.