Logging all commands run

[simon@bp]

Is there any way to force logging of all commands run by an unprivileged user? For example, can SELinux be configured to log all commands via syslog?

If there is, is there also a way to whitelist some commands which do not need to be logged (with specific paths, not editable by the user)?

[tunk]

Not quite what you're asking for: /home/$USER/.bash_history
I guess you could make periodic copies of these files.

[TrevorH]

It's possible to do something like this with the audit daemon but I only know that in theory having seen others post that it can be done. However, it will produce reams of output and managing that is a task in itself. It may also have sufficient overhead that it may have a performance impact as well as generating large volumes of data in /var/log/audit.

A quick google shows https://serverfault.com/questions/47075 ... on-servers which looks like it might be adapted to do what you want.

I'd rather suggest that you use sudo and that already logs who did what and when.

Oh, and this is in the CentOS 6 section - is that what you are running? Don't forget to get off it soon!