How to know which user is messing up with the system?

Hello,
In our environment some users mess up with the system ( install / uninstall ) software..
unfortunately the root is open to several users (several of them have sudo access)
How to track which user is trying to do this ( I'd like to know which user and what ipaddress. )

Experts please shed some light; how to approach to take control of the situation (systems) and avoid future incidents.

Thanks,
R

Check the authentication log (/var/log/auth.log). It will tell you who logged in to your server, when, and what he/she did.
Alternatively you can also check their respective history files to see what commands they ran.

If you can change the root password and removing the sudo privileges to switch user to root, even better. No access means no chance of errors by them again. Be careful with sudo rules though. Some commands sudh as vi, ftp and seemingly harmless more may allow you to escape to a shell prompt as a root privilege user. Work on the basis of allowing as little as possible for everything.

If you have to share access, do you have a line in your /etc/syslog.conf (or rsyslog.conf) for:-

*.debug       /my/system/log

If so, then there may be some clues in there, whatever it is defined to. The problem may come in working out what action caused the problem, when it happened and then tracing back. Perhaps you could include some tracing in your /etc/profile to record more useful information.

I hope that this helps,
Robin
Liverpool/Blackburn
UK