Hello,

I am using IBM AIX 5.3 OS release 16 on Power 520 Servers. I have installed "Oracle Application Server" on it & for website purpose.

Now, I have provided oracle user access to another company,who is maintaining Oracle Web Server.

So, I would like to know how to track their activity like,

* User who have logged into AIX Server with time frame with their IP Address.

* Failed login attempts on AIX Server.

* Which file they have changed with modification date & contents of the file that has been modified.

Is it possible to get all above 3 outputs in a simple txt file, so that i can import it & make hard copy print.

I am doing this exercise for my internal audit purpose only.

Please help.

last
who -a /etc/security/failedlogin
Are you looking for diff with the former contents? Where do you keep the old contents?
It is possible if you make some effort.

This is going to be difficult. You could obviously use find to look for files owned by a certain user and last modified time but thats not going to help you in situations where group write has allowed a file to be modified by a number of users etc..

AIX auditing may help you, http://www.ibm.com/developerworks/aix/library/au-audit/ . Its something i've not actually used myself though.