Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this community
I've done some research and it looks like that the way linux keeps history is less about security and audit and more about helping the user.
Even after making changes to instantly log the command and space commands the command still wont log till finished.
Is there any way to improve audit logging other then possibly writing a module for the linux kernel that will instantly log whatever is typed?
The shell command history is not an auditing tool, although misguided people may attempt to use it as such.
The audit subsystem, on the other hand, can be set to record every exec() system call and their arguments, and/or any file accesses.
You could install sudosh2 and use it as the login shell for users. It will record everything that happens in the session, both commands and their outputs.
