topic Re: how to trace a command in Operating System - HP-UX

how to trace a command

Brian Lee_4 — Mon, 05 Jan 2004 16:13:12 GMT

one of unix users deleted one directory.
Unfortunately, the user doesn't have ~/.sh_history file so that I can not trace who deleted the directory.

Does anyone know how to trace a command run by a specific user ?

Re: how to trace a command

Michael Tully — Mon, 05 Jan 2004 16:18:36 GMT

Unless the user has a .sh_history or equivalent, (depending on the type of shell) the answer is no, unless you run system auditing, which is probably unlikely.

Re: how to trace a command

Michael Schulte zur Sur — Mon, 05 Jan 2004 16:21:07 GMT

Hi,

is that for future purposes or for this incident?

greetings,

Michael

Re: how to trace a command

Sanjay_6 — Mon, 05 Jan 2004 16:22:34 GMT

Hi,

You cannot trace a command unless it is stored in the history. Had this been a system related command, you could have tried syslog.log where it logs some systems command.

Hope this helps.

Regds