I'm trying to set up RBAC, and I need to know where the logs for RBAC are.
I'm using Solaris 10 as my OS.
I've been reading a lot of documents online and just can't seem to find where the related logs are.
My problem is I need to be able to track a user when they su to a role profile, and what commands they use.
If there are no RBAC logs I may have to set up audit logs. I have never done this.
Any help would be great.
/var/adm/sulog file will show you who sued to a profile.
the .sh_history or .bash_history file within the profile's/user's home directory would capture the commands issued.
Thanks this a good start. RBAC profiles don't normally have a home directory, so sh_history or .bash_history will not work for commands.
I need to see what commands a user uses under anther profile.
Lets say the profile name is tape and the user name is username. If username logs into the system and needs to use the tape drive he will then need to su to tape.
I need to see what username is doing while using the role tape. I need to be able to see the commands username is using, but not to be confuse by the commands of other users.
Thanks for your help