topic Re: user activity log in Operating System - HP-UX

user activity log

cch_1 — Wed, 18 Jan 2006 01:52:27 GMT

my system (HPUX) is not a trusted/ audited system.
But i would like to retrieve a user activity log ( other than the shell history file )

Is that any clues or any areas I can trace the user activity ?
thank you.

Re: user activity log

RAC_1 — Wed, 18 Jan 2006 01:55:57 GMT

You have very limited options without trusted system/audited system and .sh_history file.

Look at man page of script. But these files grow very fast.

Re: user activity log

Arunvijai_4 — Wed, 18 Jan 2006 01:59:10 GMT

Hello,

You can do it by setting up history command,

In user's .profile, add the following line
HISTFILE=$HOME/.sh_history ; export HISTFILE

-Arun

Re: user activity log

cch_1 — Wed, 18 Jan 2006 02:04:03 GMT

Thank you. I have already enabled history in my system.

Other than shell history, what can I do in order to trace the user activity in 1-2days ago ?

Re: user activity log

Arunvijai_4 — Wed, 18 Jan 2006 02:38:16 GMT

Hello,

Check your system log files, /var/adm/syslog/syslog.log , OLDsyslog.log, mail.log.

-Arun

Re: user activity log

Cem Tugrul — Wed, 18 Jan 2006 03:20:33 GMT

Hello,

Here are some links may help to you;

http://forums1.itrc.hp.com/service/forums/bizsupport/questionanswer.do?threadId=218820

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=109749

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=740203

Good luck,

Re: user activity log

Devender Khatana — Wed, 18 Jan 2006 03:26:18 GMT

Hi,

The commands are listed in the history file as mentioned earlier. You can see that and also use history command.

#history -1000

There are no other footprints available by default.

HTH,
Devender

Re: user activity log

Nguyen Anh Tien — Wed, 18 Jan 2006 22:38:05 GMT

each user has his/her own history file. It located at ~.sh_history by default!

Re: user activity log

rariasn — Thu, 19 Jan 2006 02:09:05 GMT

Hi cch,

Modify /etc/profile, and add,

DATE=`date +%d_%b_%o_%a_%R:%S`
DEST=`hostname`
ORI=`who -R am i | awk '{print $6}' | cut -c2- | cut -f1 -d ')'`
mkdir -p $HOME/.historicos
HISTFILE=$HOME/.historicos/$DATE.$DEST.$ORI.$LOGNAME.txt
export HISTFILE
HISTSIZE=16384
export HISTSIZE