Logging/Audit Trail

• Modify your syslog.conf as appropriate
• Logs on each machine ... and then central log for everything
• 18,916 sudo (root type) actions in DOMAIN for the month of March/1997
• 2,813 on HOST1, 1,226 on HOST2, 594 on HOST3, etc.
• 1,250 for SA1, 1080 for SA2, 892 for Alek, etc.
• I.e. we know who did what when (sample log entries)
  
  
• Some sort of log filtering (Swatch! ;-) is handy
• 261 "su root`s" ... necessary at times, but still too many IMHO (What did they do?)