Find who execute command in a server

msmystic — Tue, 23 Jun 2020 06:32:08 GMT

Hello,

I am currently doing an audit to a server. I would like find a history like who run/execute certain commands in the server. May I know which dir should I look at, or any tips can be share since I'm not really familiar into this auditing stuff?

Re: Find who execute command in a server

MK_J — Tue, 30 Jun 2020 10:53:03 GMT

You would first require to enable auditing in the server and then define policy as per your site requirement.

You can define policy to audit selected events for success, for failure, or both.

Also, which users and events need to be audited, based on the site policy.

Following white paper defines how to configure and manage Auditing in HP-UX 11i v2 and 11i v3 :

https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=emr_na-c02899022

Note that you cannot get historical data if auditing was not enabled in the server.

Audit logs get populated only after enabling auditing in the sever.

You may log a case with HPE support if you have any specific issue with system audit.

Regards,

topic Re: Find who execute command in a server in Operating System - HP-UX

Find who execute command in a server

Re: Find who execute command in a server