[NTLUG:Discuss] Monitor user's activity

[tr_data1]

I'm in search of some good ways to monitor the activities of users.
Some of our test systems have questionable actions being done by
valid accounts.  Linux (Redhat) and Solaris.

The problem with the shell's history is a) no timestamps b) ways to
delete it or otherwise alter, etc. "last" just tells me when they are
logged in and from where.

Short of writing a little script that uses "date" and "ps", any ideas?

Perhaps some good web sites and/or books I could look at. Again,
this is for users that are to have accounts -- they just aren't
honest.  :-(
=TR=