Can I log vi activity?

Solution 1:

You can also turn on process accounting ( s/can/should/ !)

You can then use:

lastcomm(1)

to see the command run and if they were run after a fork, with or without an exec.

Combined with a host based IDS this should give you what you need "that the King's justice may be done upon him."

Solution 2:

How are you logging their activities right now? The easiest is to block them from launching shells from vi.

# vi /home/user/.exrc
set exrc
set shell=/bin/false
# chown root:root /home/user/.exrc
# chmod 644 /home/user/.exrc
# chattr +i /home/user/.exrc

If you're using a special shell to log their commands, you could change vi to use that shell only.