topic Re: file access info in Operating System - HP-UX

file access info

Henry Chua — Thu, 09 Jun 2005 03:20:12 GMT

Hi Guys,

Just curious to know, is there anyway I can know when a executable file has been used? and if it was called by another program can I know which program was doing the call?

If not can I write a program to keep any of this future information in a log file, how can this be done?

Thank u

Re: file access info

Muthukumar_5 — Thu, 09 Jun 2005 03:30:06 GMT

You can get the file access information with,

ls -lu

We can find the execution of specific file with history file or system auditing.

hth.

Re: file access info

Henry Chua — Thu, 09 Jun 2005 04:24:27 GMT

Hi Muthu,

Thank you for the info. Can you elaborate on the latter suggestion? does HPUX has a history or audit application i can utilise in this case. Or should I write a script to do this?

Best regards
Henry

Re: file access info

jpcast_real — Thu, 09 Jun 2005 04:32:38 GMT

Henry ,

You can enable the auditory in the server . However I prefer to create a centralized store for all the histories of every user .

I have introduced in my /etc/profiles

USER1=`id -nu`
USER2=`who am i | awk '{print $1}'`
tty=`who am i | awk '{ print $2 }'`
FROM=`who -a | grep -i $tty | awk '{print $NF }'`
SCREEN=`who -u -m | awk '{ print $NF }'| sed 's/:/ /g' | awk '{ print $1 }'`
export DISPLAY=$SCREEN:0.

TTYTEMP=`tty`
TTY=`basename $TTYTEMP`
FECHA=`date +%d%b%Y`
HORA=`date +%H%M%S`
export HISTFILE=/.history/${USER1}-${USER2}.${TTY}.${FECHA}.${HORA}
export PS1=`hostname`':$PWD> '
EDITOR=vi
export $EDITOR

It creates a history for each user in a "hidden" folder

Re: file access info

Devender Khatana — Thu, 09 Jun 2005 04:38:56 GMT

Hi,

For history we export these two lines in /etc/profile for all users or for a indivisual user in his .profile.

export HISTFILE="/path_to_file/$LOGNAME"
export HISTSIZE=1000

Here /path_to_file directory should be writable by user for which you are exporting history.
This will create a file with user name in this directory.

HTH,
Devender

Re: file access info

Muthukumar_5 — Thu, 09 Jun 2005 04:39:27 GMT

We can get the history of each user information with /etc/profile setting as,

set -o $EDITOR
HISTFILE=$HOME/.sh_history_$LOGNAME_$(date +'%d-%m-%y_%X')
HISTSIZE=1000

so that it will create history information in users home page with .sh_history_(login name_ date_time)

If you want to audit the user command execution then you have turn your system into trusted one.

You have to use /usr/lbin/tsconvert utility to do it or using sam also u can do it.

hth.

Re: file access info

Henry Chua — Thu, 09 Jun 2005 04:42:56 GMT

Hi Javier,

Thank you for the info.. actually my problem is that a program (say X) running on my workstation seems to behave strangely, as it is an object files, i can't see their content. But I seriouly will like to know which program running on the background is executing X and when the execution is being carried out? Can this be done?

Best regards
Henry

Re: file access info

Muthukumar_5 — Thu, 09 Jun 2005 06:08:26 GMT

X process will be startup process for the session so that you can it with who -u. IF some is using x windows who -u will give that command. Process ID will be in that execution.

hth.

Re: file access info

Devesh Pant_1 — Fri, 10 Jun 2005 00:02:38 GMT

Henry,
try to find the pid of the original x session that starts then you can do a grep for the pid that is running the x program.
ps -ef| grep pid

This will give you quite a few.
if you want a specific filesystem details,
you can do a
fuser -c /var
and that will give you all the pids accessing any files on say /var
Try to match the pid of your original x program or it's children to the list you just got from fuser.

Devesh