topic Re: Is there a LOG.file in Operating System - HP-UX

Is there a LOG.file

Onan Coca_1 — Thu, 05 Sep 2002 19:14:58 GMT

I am trying to find who stoped some processes in my server.
I would like to pull information of who was in my server and what commands where used at a specific date and time.
Is there a LOG file that I could pull up and get this information.

Thank you in advanced

Re: Is there a LOG.file

S.K. Chan — Thu, 05 Sep 2002 19:32:37 GMT

You may be able to get some level of details but definately not to the extent of exact time unless your have accounting or auditing turned on on your machine. First use "last" command to find out who has been logging onto the server. Also take a look at /var/adm/syslog/syslog.log to find out where the connection is coming from. Once you have some idea who the suspected user is, you would then check if that user has HISTFILE setup in his/her .profile, if yes you can look at ~/.sh_history of that user. Still if the user is smart, the command trace can be deleted. Hope this helps a little ..

Re: Is there a LOG.file

harry d brown jr — Thu, 05 Sep 2002 19:39:36 GMT

Are you sure "someone" stopped them or could they have just terminated? Could have the applications aborted? maybe they terminated on their own? And then again, maybe a user terminated them? Or maybe another process terminated them?

It's funny how we react to incidents AFTER they occur, instead of being PRO-active and eliminating users from having SHELL access in the first place. Therefore I'll suggest you take the first approach, remove shell access from your users.

live free or die
harry

Re: Is there a LOG.file

Sridhar Bhaskarla — Thu, 05 Sep 2002 19:42:02 GMT

Hi,

I would do the following

-Get the time coordinates of the incident
-Use "last" command to find out the users that logged in during those time limits.
-Verify the .sh_history of each of the user.

There is no 100% guarantee that you will get 100% information with the above.

-Sri

Re: Is there a LOG.file

Brian Crabtree — Fri, 06 Sep 2002 02:04:13 GMT

If this is an Oracle database, you would be able to see some of this information in the audit trails. This is normally found under $ORACLE_HOME/rdbms/audit, and would be listed by time.

Brian