Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.
What audit rule to be added to get USER_TTY record
whether it will record all the executed commands under msg field?
Enable pam_tty_audit, by placing this line in your /etc/pam.d/ files:
session required pam_tty_audit.so disable=bounce enable=root
Required, but never shown
1 month ago
29 days ago