Help answer threads with 0 replies.
Go Back > Forums > Linux Forums > Linux - Newbie
User Name
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!


  Search this Thread
Old 06-04-2010, 05:41 AM   #1
Registered: Jan 2009
Location: Coimbatore, India
Distribution: rhel
Posts: 49

Rep: Reputation: 3
created files after login

How to find, what are the files (system & user) created after login to the system in RHEL 5.0?
Any single command available?
Old 06-04-2010, 07:20 AM   #2
LQ Guru
Registered: May 2005
Location: Atlanta Georgia USA
Distribution: Redhat (RHEL), CentOS, Fedora, CoreOS, Debian, FreeBSD, HP-UX, Solaris, SCO
Posts: 6,948
Blog Entries: 14

Rep: Reputation: 1163Reputation: 1163Reputation: 1163Reputation: 1163Reputation: 1163Reputation: 1163Reputation: 1163Reputation: 1163Reputation: 1163
You could create a file in /tmp that has the time of the login you're interested in with the touch command:

e.g. to create file for 3:30 PM on June 3rd:
touch -t 201006031530 /tmp/findref
You then do a find looking for files newer than the time on that touched file and owned by the user in question:

find / -newer /tmp/findref -a -user <username>
Of course if the user had permission to become root or another user with the su command and used that other user to create the file he wouldn't be the owner and there's no easy way to find it. You could try running "strings" on .bash_history (or .sh_history for ksh) in his home directory to see what commands he executed but that won't tell you WHEN he executed them. You could also do it for whatever user he su'd to.



Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
Cannot login with the new created user thomas2004ch Linux - Software 1 05-27-2010 06:34 AM
I cant login using an user I haveve created! ssobeht Slackware 2 08-20-2004 08:02 AM
I can't login with newly created user r_ibsen Linux - Newbie 2 06-19-2004 08:32 AM
cannot login as newly created user in terminal linoops Linux - Newbie 1 06-04-2004 08:07 PM
Login problems after account is created ipsrus Linux - Newbie 2 05-04-2004 03:11 PM > Forums > Linux Forums > Linux - Newbie

All times are GMT -5. The time now is 09:42 AM.

Main Menu
Write for LQ is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration