Finding the ip from where the commands are fired

[nish_1]

Hi,

I would like to know in linux how to find out the terminal from where the commands are fired and if possible the IP address of the machine where the terminal is opened.

This is required as continuous deletion of my project folders and files are happening though we have separate userid and password for the project.

TIA

[Dennis Handly]

Who has permission to delete your directories and files? Only you and root?
Any crontab entries to delete "old" files?

[nish_1]

The user we use has the execute permissions also.whomever logins with this userid have full access to the files

[Hemmetter]

Hi Nish

have you tried last(1)?
It list all that info.

rgds
HGH

[nish_1]

Hi,

last command gives the output as follows

nish pts/7 10.66.123.221 Tue Mar 2 13:45 still logged in

I require the command fired from this particular terminal along with IP.Can u please suggest?

[Hemmetter · Accepted solution]

Hi nish,

have a look at your shell-history ( e.g. ~/sh_history, ~/.bash_history etc) or if no history is configured have a look at sh(1), bash(1) or csh(1) etc. to configure one.

e.g. add lines like this to /home/nish/.bashrc:
export HISTFILE=~/.bash_history_$(basename $(tty) )
export HISTTIMEFORMAT='%F %T '

The you can audit all commands invoked.


rgds
HGH

[nish_1]

Hi Hemmetter,

After exporting these variables in the home directory .sh_history file got formed instead of a file like .bash_history_7.Can you pls explain on this?

[nish_1]

thanks Hemmetter.It worked and now i can track it :) .

[nish_1]

Magical answer

[Hemmetter]

Hi again

the HISTFILE variable in this form distingishes between the tty's and makes it possible to relate it to IP-Address via last-output.

rgds
HGH