LinuxQuestions.org
Support LQ: Use code LQ3 and save $3 on Domain Registration
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 05-20-2009, 08:24 AM   #1
Jeetn
LQ Newbie
 
Registered: May 2009
Posts: 1

Rep: Reputation: 0
History logs


Hello,

How can I check, which command is fired or run by which user and at what time on linux server ? We can see history of commands using history command.

#history



Jeet N.
 
Old 05-20-2009, 08:47 AM   #2
MensaWater
LQ Guru
 
Registered: May 2005
Location: Atlanta Georgia USA
Distribution: Redhat (RHEL), CentOS, Fedora, Debian, FreeBSD, HP-UX, Solaris, SCO
Posts: 6,580
Blog Entries: 14

Rep: Reputation: 969Reputation: 969Reputation: 969Reputation: 969Reputation: 969Reputation: 969Reputation: 969Reputation: 969
The history files (.bash_history for bash, .sh_history for ksh) are just command history files to make it easier to reuse the command. They aren't really designed for auditing which is what you want to do. You can do "strings" against such files for users (in their home directories) to get the commands but they won't have time stamps associated. Also since this history files roll over time they won't have all commands. It is a good place to look if you suspect a specific command was issued and want to find out who did it but it doesn't really prove it because you can't tell WHEN they did it. (Usually you don't have to prove it - people are generally shocked enough that you figured out it was them.)


To really do full auditing you need to plan for and turn on system accounting. This does quite a bit of logging so you'd need to plan for having a lot of space for that.
This page may help (I found it with a Google search):
http://www.faqs.org/docs/Linux-mini/...ccounting.html
 
Old 05-20-2009, 10:48 AM   #3
*******
Member
 
Registered: Feb 2009
Posts: 63

Rep: Reputation: 16
I wonder what process accounting actually can provide when auditing from an accountability point of view? Does output from for instance lastcomm include relevant details like command arguments?
 
Old 05-20-2009, 12:19 PM   #4
MensaWater
LQ Guru
 
Registered: May 2005
Location: Atlanta Georgia USA
Distribution: Redhat (RHEL), CentOS, Fedora, Debian, FreeBSD, HP-UX, Solaris, SCO
Posts: 6,580
Blog Entries: 14

Rep: Reputation: 969Reputation: 969Reputation: 969Reputation: 969Reputation: 969Reputation: 969Reputation: 969Reputation: 969
Don't know because I've never enabled this in all the years I've been doing UNIX/Linux. I know that some organizations do (or did) charge internal departments based on computer usage based on the accounting.

There is a rather interesting documentary (and book I think and maybe later a movie) called: The CIA, The KGB and Me. It was about a guy noticing discrepancies in such an audit that led him to discover that East German spies were using his system (and others) to hack into things like the Pentagon. I gather from what I saw in that you can get quite a bit of detail.

Reading the link I posted above might be a good start.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
tcsh: can you save the history from multiple shells to one history file? BrianK General 2 04-23-2009 06:19 AM
Finding LDAP Server Logs / Application Logs in Linux arbignay Linux - Newbie 2 03-24-2008 10:54 AM
Download history and copy history? inverted.gravity Linux - Newbie 1 02-21-2006 01:31 PM
Firefox logs user out? Where are error logs? case1984 Linux - General 0 10-09-2004 03:22 PM
Separate firewall logs and general logs dominant Linux - General 3 04-20-2004 02:26 AM


All times are GMT -5. The time now is 07:00 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration