topic Re: Tracking rm and/or .sh_history in Operating System - HP-UX

Tracking rm and/or .sh_history

TheJuiceman — Thu, 28 Jul 2005 18:21:45 GMT

Is there a way to script something to track all rm, redirects, mv ... any command that could delete or change a file? What about getting .sh_history if it is altered with?

Thanks.

Re: Tracking rm and/or .sh_history

Cheryl Griffin — Thu, 28 Jul 2005 18:56:51 GMT

See Bill's response (Nov 27, 2001 21:40:52) in
http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=113459

Re: Tracking rm and/or .sh_history

Vibhor Kumar Agarwal — Fri, 29 Jul 2005 03:37:51 GMT

One more option,

Just write the command
script logfile
in .profile of all users.

Not all that the users will write will go into that logfile.

Re: Tracking rm and/or .sh_history

Muthukumar_5 — Fri, 29 Jul 2005 03:58:44 GMT

You can put a script in /etc/profile for generating history of separarte users as like,

# Create a directory like,
mkdir /var/history

-- /etc/profile --
set -o $EDITOR
export HISTFILE=/var/history/.history_${LOGNAME}
export HISTSIZE=1000

Another way,
you have to put shell wrapper for generating individual logs for rm, mv commands. Like cd command in,
http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=939679
write a wrapper for yours.

hth.