[ Thanks to An Anonymous Reader for
this link. ]
“Intrusions can take place from both authorized (insiders) and
unauthorized (outsiders) users. My personal experience shows that
unhappy user can damage the system, especially when they have a
shell access. Some users are little smart and removes history file
(such as ~/.bash_history) but you can monitor all user executed
commands.“It is recommended that you log user activity using process
accounting. Process accounting allows you to view every command
executed by a user including CPU and memory time…”