RE: HOW do i..

["Andrej Borsenkow" <Andrej.Borsenkow@mow.siemens.ru>]

>
> is there a way to simultaneously log user's activity under root?
>

There is no zsh-internal way that cannot be overcome by user. As suggested,
use tty spy programs. Besides, depending on options, not everything may be
saved in history (or in wrong order).

You may use preexec function to log current command, but you cannot prevent
user from un- or re-defining it. See below.

> >
> > The most you can do is to use fc command to write *current* entries (up to
> > HISTSIZE) to some file at logout. But, how can you prevent user
> from modifying
> > .logout, TRAPEXIT ot whatever?
>
> -rw-r--r--  1 root  wheel  87 Dec 26 19:42 /etc/zshrc
>

???

setopt norcs
unset TRAPEXIT

I used wrong word, sorry. I did not mean "modifying zlogout". I meant, that
user can always prevent zsh from running it, can unset/change any
variable/function.

-andrej