Home / server / Questions / 1068800
In Process
catalin
Asked: 2021-07-07 05:40:29 +0800 CST

not able to see user activity while being in sudo -i

  • 772

I usually execute "watch -n0.1 w" to see what user is continuously doing. However, if the user executes "sudo -i", becomes root and executes something, I cannot see his activity anymore.

Take the following example: I have 3 sessions open. On first session, I am checking "watch -n1 w" to see what other users are doing. On second session, I'm executing "sudo -i", then "vim session2.txt". On third session, I'm executing "vim session3.txt"

Every 1.0s: w

15:31:37 up 63 days,  3:54,  3 users,  load average: 0.05, 0.29, 0.26
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
user1   pts/1    192.168.1.13     14:40    4.00s  0.50s  0.02s sshd: user1 [priv]
user1   pts/2    192.168.1.13     15:21    9:37   0.18s  0.02s sshd: user1 [priv]
user1   pts/3    192.168.1.13     15:24    7:21   0.14s  0.05s vim session3.txt

As you can see I cannot see that on session 2 the user is doing "vim session2.txt" (being in sudo -i), but I can see on session 3 that user is doing "vim session3.txt"

linux

1 Answers

  1. If you need to see anyone running privileged commands using sudo in watch you need to run your watch in sudo as well. Try the following, it should work

    sudo -S watch -n1 w

    Update: Sorry, this answer only works on BSD :(

    • 0