How to log administrator activities in Red Hat Enterprise?

Question

Is it better to use auditd or sudo logs to log root and other user activities on a Red hat enterprise machine?

score 3 · Accepted Answer · edited Apr 13 '17 at 12:14

3

Auditd and a remote syslog server, as a root user could potentially alter any local logs.

Some more details can be found here.

edited Apr 13 '17 at 12:14

Community

answered Apr 28 '15 at 03:41

aportr

Note that auditd can slow down a system significantly. – Jenny D Apr 28 '15 at 08:28

1 Answers1