topic Re: Last time an executable file was run in Operating System - HP-UX

Last time an executable file was run

Gilbert Standen_1 — Sat, 23 Dec 2006 17:55:40 GMT

Hi,
I'm wondering if there is a way to list files and show the last time a file was run. Not the last time it was accessed for edit, but the last time it was executed. This would be very useful for situation where I've been developing and have older versions of a script in the same directory, and want to be sure which ones are actually executing and being called, etc. Best Regards, Gil

Re: Last time an executable file was run

James R. Ferguson — Sat, 23 Dec 2006 19:52:36 GMT

Hi Gilbert:

The 'atime' (last access timestamp) will be updated any time a file is read or executed. No "last execution" time is available.

For what it's worth, for non-root users to execute a file that requires interpretation, as for instance as a shell or Perl script, the user must also have read-access to be able to execute it.

Regards!

...JRF...

Re: Last time an executable file was run

Joel Girot — Tue, 26 Dec 2006 03:45:20 GMT

Hi Gilbert,
you can add in your script this line to know the date and time of each execution :
touch /tmp/$(basename ${0})_$(date +%y%m%d)_$(date +%H%M).log

Best regards
Joel

Re: Last time an executable file was run

SANTOSH S. MHASKAR — Tue, 26 Dec 2006 05:48:10 GMT

Hi Gilbert,

It is not possible to get the time when a
file last executed.

U can log the execution time by adding few lines
in the executable if it is a text file as suggested by Joel,

Add these lines to the script

# Start of script

echo "`dirname $0`/`basename $0` executed at time `date` by user `id -un`" > /tmp/some_logfile

ur script

# End of script

OR if the file is binary then call this file
from a script as follows

# Start of script

echo "`dirname $0`/`basename $0` executed at time `date` by user `id -un`" > /tmp/some_logfile

with arguments

# End of Script

-Santosh

Re: Last time an executable file was run

SANTOSH S. MHASKAR — Tue, 26 Dec 2006 05:55:03 GMT

Sorry, a small typing mistake

Pl. read

echo "`dirname $0`/`basename $0` executed at time `date` by user `id -un`" >> /tmp/some_logfile

instead of

echo "`dirname $0`/`basename $0` executed at time `date` by user `id -un`" > /tmp/some_logfile

so that the file /tmp/some_logfile will not get
overwritten

-Santosh

Re: Last time an executable file was run

Gilbert Standen_1 — Tue, 02 Jan 2007 19:21:21 GMT

Excellent insights all. When we say "last time a file was read" (atime) what are we talking about? Doing a "cat" or a "more" -- that is not a "read" is it? If I vi a file and save it without changing the file (q!) is that a read? It is mentioned in one post that whenever a file is "executed or read"...so "atime" would tell you only that it was executed OR it was read, but would not allow you to know which event had occurred, whereas the method of embedding some code would tell you that information. It surprises me that the OS does not track this, because you would think from a security standpoint an admin would want a way to investigate when and by who an executable was last run. Anyway, I am very grateful for the excellent replies to my post!

Re: Last time an executable file was run

Bill Hassell — Tue, 02 Jan 2007 20:14:57 GMT

There are exactly 3 timestamps for all files and directories in Unix. atime means access time so reading a file is accessing a file regardless of whether what tool was used to read the file (vi, kernel scheduler, cron, etc). The access time always changes when the file is opened regardless of what else is done with the file. Execution is Unix is the process of reading the file into memory (or executing an interpreter to execute a script). There is no timestamp for this. If a change is made to the file, then the modification time is also changed. The other time stamp has to do with inode changes which means ownership and permissions.

While it may seem to be an oversight not knowing when a file was executed, that information by itself is not very complete from a security point of view. The administrator or audtior would need to know what user executed the file, what tool was used to start exscution (ie, shell command, script, another program, cron, etc) and all the parameters given to the program through the command line and/or a configuration file.

Proper management of executables requires the use of source code control and version numbers in every production executable. The what command can report on version information and detailed auditing techniques might include logging the what string prior to execution.