How to track the command fired on a Putty?

Question

Is there any utility which will monitor all commands on SSH SHELL fired by any user who logs in using putty or any other client? If this record is saved somewhere, That will be of great help.

Answer 1

Linux comes with powerful tools for auditing user actions.

SuSE has an excellent overview of how to use them that should work for any distribution that ships the necessary tools and kernel components. To keep track of which programs users are running, you'll want to track the exec() system call. You can also track which files are edited, and other system calls like changing permissions or opening sockets.

That works on a pretty low level on the system though. Another alternative is to log each user's entire SSH session. If both of those options are too heavy for you, slhck's suggestion will do fine, but that's easily circumvented. Neither of my suggestions are necessary infallible either.