Trace Crontab Edit User's Details

eprasa4 · 05-11-2016, 05:00 AM

Dear All
I'm working on an AIX environment. Someone has changed one lpar's crontab.
Can you please give instructions to trace this
How I find who has done this and what's date , time , user id and ip ...

wingnut64 · 05-11-2016, 11:54 AM

I assume you don't have auditing on and they didn't do it via something that logs the action like sudo... The only thing that comes to mind is to check the /u/*/.sh_history files for references to cron, and correlate the modification dates in /var/spool/cron/* with logon events.

Note if you grep the .sh_history you need to pass it through

Code:

tr -d "\000"

as it has some non-printable characters.

eprasa4 · 05-11-2016, 11:01 PM

Thanks you very much for the given help,
Actually this is a audit enable area , but I'm new to AIX
It's much appriciate If you can tell me how to view audit logs and trace this

wingnut64 · 05-12-2016, 09:04 AM

I don't know them off-hand but I believe there are specific audit events for cron & at job modification and execution. See 'man audit', which lists the location of the config files that control what is audited and where the logs are written.