Where is the log file for all commands that have been run?

byronk · 04-05-2006, 08:32 PM

Hey guys,

I was just wondering where the log file is located for all commands that have been run on a redhat linux server. Something dodgey has been going on so I would like to be able to print out the logs and go through them manually. Then i'll run RKhunter.

Any help is really appreciated guys, and thanks for taking your time to read.

Regards,
Byron.

gilead · 04-05-2006, 09:21 PM

The logs for what your daemons have been doing are usually under /var/log

The logs for the commands run by users is a much more rubbery question. Many shells maintain a history list for users (for example, bash maintains a command history under ~/.bash_history), but whether and where applications log user commands is up to the application. As far as I know, most applications don't log user commands.

twantrd · 04-06-2006, 01:56 PM

You would need to setup process accounting if you wanted to log all commands by users.

-twantrd

gilead · 04-06-2006, 02:42 PM

twantrd is correct - have a look at http://www.tldp.org/HOWTO/Process-Accounting/index.htmlfor more info on this.