Download your favorite Linux distribution at LQ ISO.
Go Back > Forums > Linux Forums > Linux - Server
User Name
Linux - Server This forum is for the discussion of Linux Software used in a server related context.


  Search this Thread
Old 08-17-2009, 09:10 AM   #1
LQ Newbie
Registered: Apr 2009
Posts: 22

Rep: Reputation: 0
How to Find who changed /etc/hosts file

How to Find who changed /etc/hosts file?

Old 08-17-2009, 09:39 AM   #2
Senior Member
Registered: May 2009
Location: london
Distribution: centos5
Posts: 1,137

Rep: Reputation: 116Reputation: 116
Originally Posted by yuanjunliang View Post
How to Find who changed /etc/hosts file?

for past -
depends how users log into your system and become root.
you could search .bash_history files, but then if the user logs in as root, then you may never know.

for future -
setting up sudo access for all users, logs all root commands by default
Old 08-17-2009, 10:10 AM   #3
Senior Member
Registered: Jan 2005
Location: Melbourne, Australia
Distribution: Debian Buster (Fluxbox WM)
Posts: 1,391
Blog Entries: 52

Rep: Reputation: 360Reputation: 360Reputation: 360Reputation: 360
Assuming it wasn't malicious (in which case the log files may have been changed) and was done via a user account sudo to root (or external ssh), you could examine /var/log/auth.log to see who logged in to root at the time the /etc/hosts file was last changed.


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
Path changed, I cant find where the problem is kramed Fedora 3 03-27-2008 02:25 PM
Hosts file has changed on installation. mooshie Fedora 2 10-16-2005 05:28 PM
find: . changed during execution of find suse degraffenried13 Linux - General 3 12-12-2004 08:13 PM
Changed modems: eth0 cant find IP address suggardaddy4242 Linux - Newbie 2 09-09-2004 12:45 PM
does the /etc/hosts file work same as the M$ hosts file? Lleb_KCir Linux - Software 6 04-03-2004 05:33 PM > Forums > Linux Forums > Linux - Server

All times are GMT -5. The time now is 07:29 PM.

Main Menu
Write for LQ is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration