Which user has run which command that can be traceable by : (date) pstree -p | grep date —> pid sudo grep pid /var/log/auth.log Or sudo grep pid /var/log/secure
Is there any alternative way to trace if all members are using same username (root) for login ?
Advertisement
Answer
You are out of luck. All the logs and even the bash history file would be a total mess because it does not record the virtual terminal interface (tty
) the command did come from. A proper usage would be using different users. If those users did have need to launch command using root privileges, you can manage that, you have sudo
command.
I would suggest checking super user for more specialized answers, stack overflow is more oriented to programming.