topic Re: System command Logging in Operating System - HP-UX

System command Logging

Gene Laoyan — Wed, 20 Sep 2006 11:06:34 GMT

Is it possible to log the commands a user types in at either the console or a telnet session? I ask because I want to see if someone, or hell maybe even me, issued an hpvmstop command to shut off our virtual machines. I came in today and they were all stopped.
Is this possible?

Also, how can I get the "Uptime" of the HP-UX server just in case it ASR'd? OS is HP-UX 11i v2 on an rx2620.

Re: System command Logging

mobidyc — Wed, 20 Sep 2006 11:22:08 GMT

Hello,

i think you can use script(1) for record a session user, you could put it in the user profile for automatic launch (never tested).

good luck

Re: System command Logging

Jaime Bolanos Rojas. — Wed, 20 Sep 2006 11:23:11 GMT

Gene,

I would check the history file to see if the command is listed there. It won't tell you who did it, but we asume it was somebody with root privileges.

Also if you need to track those type of things down, I would convert to a trusted system or install sudo in the machine, to give priviledges to what users can execute or even check what user what the one that exected a certain command in the future.

Regards,

Jaime.

Re: System command Logging

spex — Wed, 20 Sep 2006 11:25:15 GMT

Hi Gene,

1. The 'history' built-in will show you the last 15 commands. This command history is stored in $HISTFILE, which is set to ~/.sh_history, by default. As long as $HISTFILE is set, and $HISTSIZE is not 0, command history will be recorded.

2. # uptime

PCS

Re: System command Logging

Mel Burslan — Wed, 20 Sep 2006 11:42:38 GMT

script solution can easily be circumvented by writing over the log file byu the user issuing the questionable commands. So, even though it is a way, it does not give you the untampered logs you may want to see, right after a suspicious diappearance of a critical file.

check powerbroker from symark (http://symark.com) It has capability of logging commands to a remote server (where you keep eternal users away from). It is not free. Actually it may be quite costly for a casual logging. But at the same time, it gives you the ability to show untampered logs to the Sarbanes-Oxymoron auditors. It makes them so happy, you can not imagine :)

Re: System command Logging

Gene Laoyan — Wed, 20 Sep 2006 11:47:34 GMT

Thanks everyone!