So what we need is a slight modification to what we have done before.
And I'm going to show you history, pipe, grab, audit, CTL.
So really, it's based on this.
And what do I want?
Well, I want a line that is almost the same, but a little bit more basic.
Audit, CTL, minus A, always comma exit, minus F, there is slash home.
And then I need minus F, UID is zero.
And minus K, root, home, XS.
So that should be doing it.
Now, let's check it.
I'm going in the slash home directory.
And I'm going in the student directory.
And I'm using cat on what?
Well, let's do that on dot bash RC.
And now I'm going to grab root home on var log audit, audit dot log.
And look at that.
There we can see that all root access has been logged.
What you can also see here is that a lot of information is logged.
And one more interesting thing, do you see this number here?
The first part of the number is the timestamp in epoch.
As you have seen, use date minus D at timestamp to see what it is in human time.
Now we have 859.
The 859 is the audit event ID.
And then within the audit event ID, you can see a sequence order.
Now, what does that mean?
We have 859 starting 307 here up to 859 312.
It all belongs to the same flow of events.
So if you want to analyze step by step what exactly has happened,
then you need to read all the lines for all these different events.
But hey, I think this is enough for this lab, isn't it?