From owner-freebsd-security  Mon Jan 22 14:07:18 1996
Return-Path: owner-security
Received: (from root@localhost)
          by freefall.freebsd.org (8.7.3/8.7.3) id OAA19953
          for security-outgoing; Mon, 22 Jan 1996 14:07:18 -0800 (PST)
Received: from precipice.shockwave.com (precipice.shockwave.com [171.69.108.33])
          by freefall.freebsd.org (8.7.3/8.7.3) with ESMTP id OAA19945
          for <freebsd-security@freebsd.org>; Mon, 22 Jan 1996 14:07:15 -0800 (PST)
Received: from localhost.shockwave.com (localhost.shockwave.com [127.0.0.1]) by precipice.shockwave.com (8.7.3/8.7.3) with SMTP id OAA06279; Mon, 22 Jan 1996 14:05:59 -0800 (PST)
Message-Id: <199601222205.OAA06279@precipice.shockwave.com>
To: David Brockus <dbrockus@cyberhall.com>
cc: freebsd-security@freebsd.org
Subject: Re: Logging user activity 
In-reply-to: Your message of "Mon, 22 Jan 1996 12:32:17 GMT."
             <Pine.BSF.3.91.960122122451.602C-100000@cyber1.cyberhall.com> 
Date: Mon, 22 Jan 1996 14:05:59 -0800
From: Paul Traina <pst@shockwave.com>
Sender: owner-security@freebsd.org
Precedence: bulk

You may want to compile in the snoop drivers and the watch program, which
should be at least semi-functional in 2.0.5 (I don't recall when I made this
stuff more robust).  Other than that, I don't recall the state of accounting.

Paul

  From: David Brockus <dbrockus@cyberhall.com>
  Subject: Logging user activity
  I am running FreeBSD 2.0.5R system.  I believe there is a "hacked" 
  account on the system I maintain.  I would to extensively monitor this 
  users activity.  I want to log everything.  Any there any suggestion on 
  how to set this up or can anybody recommend any packages to do this?
  Thanks in advance.
  
  
  	   					David Brockus