LinuxQuestions.org
Help answer threads with 0 replies.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices

Reply
 
Search this Thread
Old 06-04-2010, 05:41 AM   #1
rmugunthan
Member
 
Registered: Jan 2009
Location: Coimbatore, India
Distribution: rhel
Posts: 49

Rep: Reputation: 3
created files after login


How to find, what are the files (system & user) created after login to the system in RHEL 5.0?
Any single command available?
 
Old 06-04-2010, 07:20 AM   #2
MensaWater
Guru
 
Registered: May 2005
Location: Atlanta Georgia USA
Distribution: Redhat (RHEL), CentOS, Fedora, Debian, FreeBSD, HP-UX, Solaris, SCO
Posts: 6,009
Blog Entries: 5

Rep: Reputation: 787Reputation: 787Reputation: 787Reputation: 787Reputation: 787Reputation: 787Reputation: 787
You could create a file in /tmp that has the time of the login you're interested in with the touch command:

e.g. to create file for 3:30 PM on June 3rd:
Code:
touch -t 201006031530 /tmp/findref
You then do a find looking for files newer than the time on that touched file and owned by the user in question:

Code:
find / -newer /tmp/findref -a -user <username>
Of course if the user had permission to become root or another user with the su command and used that other user to create the file he wouldn't be the owner and there's no easy way to find it. You could try running "strings" on .bash_history (or .sh_history for ksh) in his home directory to see what commands he executed but that won't tell you WHEN he executed them. You could also do it for whatever user he su'd to.
 
  


Reply

Tags
rhel5


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Cannot login with the new created user thomas2004ch Linux - Software 1 05-27-2010 06:34 AM
I cant login using an user I haveve created! ssobeht Slackware 2 08-20-2004 08:02 AM
I can't login with newly created user r_ibsen Linux - Newbie 2 06-19-2004 08:32 AM
cannot login as newly created user in terminal linoops Linux - Newbie 1 06-04-2004 08:07 PM
Login problems after account is created ipsrus Linux - Newbie 2 05-04-2004 03:11 PM


All times are GMT -5. The time now is 04:11 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration