Simpler Navigation for Servers and Operating Systems - Please Update Your Bookmarks
Completed: a much simpler Servers and Operating Systems section of the Community. We combined many of the older boards, so you won't have to click through so many levels to get at the information you need. Check the consolidated boards here as many sub-forums are now single boards.
If you have bookmarked forums or discussion boards in Servers and Operating Systems, we suggest you check and update them as needed.
Showing results for 
Search instead for 
Did you mean: 

Is there a LOG.file

Onan Coca_1
Occasional Advisor

Is there a LOG.file

I am trying to find who stoped some processes in my server.
I would like to pull information of who was in my server and what commands where used at a specific date and time.
Is there a LOG file that I could pull up and get this information.

Thank you in advanced
He who does not know is like a blind person.
S.K. Chan
Honored Contributor

Re: Is there a LOG.file

You may be able to get some level of details but definately not to the extent of exact time unless your have accounting or auditing turned on on your machine. First use "last" command to find out who has been logging onto the server. Also take a look at /var/adm/syslog/syslog.log to find out where the connection is coming from. Once you have some idea who the suspected user is, you would then check if that user has HISTFILE setup in his/her .profile, if yes you can look at ~/.sh_history of that user. Still if the user is smart, the command trace can be deleted. Hope this helps a little ..
harry d brown jr
Honored Contributor

Re: Is there a LOG.file

Are you sure "someone" stopped them or could they have just terminated? Could have the applications aborted? maybe they terminated on their own? And then again, maybe a user terminated them? Or maybe another process terminated them?

It's funny how we react to incidents AFTER they occur, instead of being PRO-active and eliminating users from having SHELL access in the first place. Therefore I'll suggest you take the first approach, remove shell access from your users.

live free or die
Live Free or Die
Sridhar Bhaskarla
Honored Contributor

Re: Is there a LOG.file


I would do the following

-Get the time coordinates of the incident
-Use "last" command to find out the users that logged in during those time limits.
-Verify the .sh_history of each of the user.

There is no 100% guarantee that you will get 100% information with the above.

You may be disappointed if you fail, but you are doomed if you don't try
Brian Crabtree
Honored Contributor

Re: Is there a LOG.file

If this is an Oracle database, you would be able to see some of this information in the audit trails. This is normally found under $ORACLE_HOME/rdbms/audit, and would be listed by time.