Hello,
I've setup the audit beat and it intercepts the commands that have sudo in front. however, it does not log the command from normal users and neither for root user.
so that, if I do sudo su there's no log of command, and neither for my user.
is it possible to enable it? how so?
i've tried this Log All User's Shell Activity but without luck
any help?