Auditbeat Log all command not just `sudo <cmd>`


I've setup the audit beat and it intercepts the commands that have sudo in front. however, it does not log the command from normal users and neither for root user.
so that, if I do sudo su there's no log of command, and neither for my user.
is it possible to enable it? how so?

i've tried this Log All User's Shell Activity but without luck

any help?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.