On Thursday, December 01, 2011 10:12:48 PM MS PRAVEEN wrote: Well, the problem is how can you tell a command being executed from a script calling various programs? Also how can you tell that a file being sourced is a command? (I think in that case a file is opened for read and the shell executes it.) I think the bottom line is its pretty hard to tell. So, what we have is key stroke logging. This gets more than commands, but wouldn't you want to log what people do if its that important? If someone knew that only commands are being logged, they could start python and just start typing commands which won't be otherwise logged. There is a man page for this, pam_tty_audit. -Steve