topic Re: command log accesibility in Operating System - HP-UX

command log accesibility

pawan agrawal — Thu, 25 Mar 2010 04:27:08 GMT

Hi

i am using hp-ux 11iv2

i need to have log of all the commands executed on the system for last 48 hrs. along with the userid & time stamp on regular basis. please help me

Re: command log accesibility

Turgay Cavdar — Thu, 25 Mar 2010 04:49:55 GMT

If you want to see "log of all the commands", then auditing must be enabled on your system with the required system calls.If auditing enabled on your system, you can use "audisp" command to see the audir file.

# /usr/bin/audisp /your_audit_file

Re: command log accesibility

pawan agrawal — Thu, 25 Mar 2010 05:32:22 GMT

how can i check auditing is enable or not, in my system there is no /usr/bin/audisp directory.

Re: command log accesibility

Turgay Cavdar — Thu, 25 Mar 2010 05:39:58 GMT

Hi,
Type :
# audsys

You should see "auditing system is currently on"...

Re: command log accesibility

Turgay Cavdar — Thu, 25 Mar 2010 05:41:55 GMT

The command audisp may be in /usr/sbin directory...

Re: command log accesibility

Johnson Punniyalingam — Thu, 25 Mar 2010 05:47:51 GMT

>>>>how can i check auditing is enable or not, in my system there is no /usr/bin/audisp directory.<<<<

# audsys
warning: /.secure/etc/audnames does not exist
auditing system is currently off
current file: ** unknown **
next file: ** unknown **
statistics- afs Kb used Kb avail % fs Kb used Kb avail %
current file: ** no data available **
next file: ** no data available **

# ls -l /usr/sbin/*aud*
-r-xr-xr-x 1 bin bin 45056 Aug 26 2004 /usr/sbin/audevent
-r-xr-xr-x 1 bin bin 86016 Jan 30 2006 /usr/sbin/audisp
-r-xr-xr-x 1 bin bin 40960 Sep 3 2003 /usr/sbin/audomon
-r-xr-xr-x 1 bin bin 53248 Aug 26 2004 /usr/sbin/audsys
-r-xr-xr-x 1 bin bin 32768 Aug 26 2004 /usr/sbin/audusr

# uname -a
HP-UX B.11.23 U 9000/800 100901507 unlimited-user license

Re: command log accesibility

pawan agrawal — Thu, 25 Mar 2010 06:03:39 GMT

auditing is currently off
o/p of root@cmd1#ll /usr/sbin/*aud* is
-r-xr-xr-x 1 bin bin 55524 Aug 27 2004 /usr/sbin/audevent
-r-xr-xr-x 1 bin bin 149076 Jan 31 2006 /usr/sbin/audisp
-r-xr-xr-x 1 bin bin 39492 Sep 3 2003 /usr/sbin/audomon
-r-xr-xr-x 1 bin bin 67932 Aug 27 2004 /usr/sbin/audsys
-r-xr-xr-x 1 bin bin 36892 Aug 27 2004 /usr/sbin/audusr

is there any method by which log of all command executed on system with userid & time for past 48 hour will automatically save in a file

Re: command log accesibility

Dennis Handly — Thu, 25 Mar 2010 06:35:04 GMT

>Is there any method by which log of all command executed on system with userid & time

Other than auditing, there may be commercial products that do this.

Re: command log accesibility

pawan agrawal — Thu, 25 Mar 2010 06:38:36 GMT

Hi

can you please provide me detail of any such product.

Re: command log accesibility

Dennis Handly — Thu, 25 Mar 2010 06:48:40 GMT