On Fri, Nov 30, 2001 at 03:13:05PM +0100, DE SMAELE Kim (BMB) wrote: > I am trying to setup an remove logging on a few of our sun E10K development > servers. > Is there any one of you who has an idea howto log every rm command ( not in > the syslog or with the sysdaemon if possible ).
You will have to recompile rm. You'll also almost certainly have to use the syslog, because anything else would require either having a world-writeable log file (rather pointless for this task) or a new setuid/setgid program (bad idea). I can't help thinking you're trying to solve the wrong problem. What happens if somebody uses the unlink() system call, or if somebody just truncates a file to zero length? You can't log everything unless you want to hack the kernel and have a great deal of time to analyse log files. -- Colin Watson [EMAIL PROTECTED]