29 ms·
disclaimer: I have no idea about Linux auditing: If you 'sudo -s' (or one of its friends) does the log still record the commands done in the "root shell"?
by tubs 10y ago
disclaimer: I have no idea about Linux auditing: If you 'sudo -s' (or one of its friends) does the log still record the commands done in the "root shell"?
- secstate 10y agoNo, but you have a record of the user who typed 'sudo -s' which gives you an idea of where to start asking questions.