- Community Home
- >
- Servers and Operating Systems
- >
- Operating Systems
- >
- Operating System - HP-UX
- >
- Re: Finding out who made changes
Operating System - HP-UX
1745939
Members
4021
Online
108723
Solutions
Forums
Categories
Company
Local Language
юдл
back
Forums
Discussions
Forums
- Data Protection and Retention
- Entry Storage Systems
- Legacy
- Midrange and Enterprise Storage
- Storage Networking
- HPE Nimble Storage
Discussions
Discussions
Discussions
Forums
Forums
Discussions
юдл
back
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
- BladeSystem Infrastructure and Application Solutions
- Appliance Servers
- Alpha Servers
- BackOffice Products
- Internet Products
- HPE 9000 and HPE e3000 Servers
- Networking
- Netservers
- Secure OS Software for Linux
- Server Management (Insight Manager 7)
- Windows Server 2003
- Operating System - Tru64 Unix
- ProLiant Deployment and Provisioning
- Linux-Based Community / Regional
- Microsoft System Center Integration
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Blogs
Information
Community
Resources
Community Language
Language
Forums
Blogs
Go to solution
Topic Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Printer Friendly Page
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО03-11-2009 04:41 PM
тАО03-11-2009 04:41 PM
Hello,
I am trying to research a situation.
We have a cron job and want to know when someone might be disabling or enabling.
We have a powerbroker client running on the servers and cronjob can be modified only by
a privileged user by doing pbrun su-someuser.
Now if i want to know which user has enabled or disabled cron jobs then which place i should be looking ?
Thanks,
Shiv
I am trying to research a situation.
We have a cron job and want to know when someone might be disabling or enabling.
We have a powerbroker client running on the servers and cronjob can be modified only by
a privileged user by doing pbrun su-someuser.
Now if i want to know which user has enabled or disabled cron jobs then which place i should be looking ?
Thanks,
Shiv
Solved! Go to Solution.
3 REPLIES 3
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО03-11-2009 05:36 PM
тАО03-11-2009 05:36 PM
Re: Finding out who made changes
You can look at the files in /var/spool/cron/crontabs/. Check the date of the files and of the directory.
Note: If a user directly modifies these files, cron(1m) may not pick up the changes because it expects crontab to signal it.
Note: If a user directly modifies these files, cron(1m) may not pick up the changes because it expects crontab to signal it.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО03-11-2009 05:54 PM
тАО03-11-2009 05:54 PM
Solution
Hi,
Try a find & grep of crontab in the user's shell history files (.sh_history). This may show you who has been using crontab; but it will not show direct editing of the crontab files. Unfortunately, a guilty part can delete the info in their shell history. Also, since there is no timestamp in the HP-UX shell history, you may wish to consider adding something like the following to /etc/profile.
# HISTORY environment variables for all users and a login timestamp
HISTSIZE=1000
EXTENDED_HISTORY=ON
HISTDATEFMT='%d/%m/%Y %H:%M:%S'
FCEDIT=/usr/bin/vi
export HISTSIZE EXTENDED_HISTORY HISTDATEFMT FCEDIT
userDetail=`who am i | tr -s ' '`
echo "## $userDetail " | read -s
echo "##\n\n" | read -s
This works on both HP-UX and AIX, and allows you to see what was done on a particular day.
Good luck
Try a find & grep of crontab in the user's shell history files (.sh_history). This may show you who has been using crontab; but it will not show direct editing of the crontab files. Unfortunately, a guilty part can delete the info in their shell history. Also, since there is no timestamp in the HP-UX shell history, you may wish to consider adding something like the following to /etc/profile.
# HISTORY environment variables for all users and a login timestamp
HISTSIZE=1000
EXTENDED_HISTORY=ON
HISTDATEFMT='%d/%m/%Y %H:%M:%S'
FCEDIT=/usr/bin/vi
export HISTSIZE EXTENDED_HISTORY HISTDATEFMT FCEDIT
userDetail=`who am i | tr -s ' '`
echo "## $userDetail " | read -s
echo "##\n\n" | read -s
This works on both HP-UX and AIX, and allows you to see what was done on a particular day.
Good luck
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО03-11-2009 07:22 PM
тАО03-11-2009 07:22 PM
Re: Finding out who made changes
Hi Shiv,
You need check the /var/spool/cron/crontabs
which cron users has been recently edited.or
cd /var/spool/cron/crontabs
ls -lrt (will show recerntly edit cron)
By this you can identify which cron has been recently edited.
finding which <
you check " sulog " on the particular day which the cron was recently edited,
Hope this Helps,
Thanks,
Johnson
You need check the /var/spool/cron/crontabs
which cron users has been recently edited.or
cd /var/spool/cron/crontabs
ls -lrt (will show recerntly edit cron)
By this you can identify which cron has been recently edited.
finding which <
you check " sulog " on the particular day which the cron was recently edited,
Hope this Helps,
Thanks,
Johnson
Problems are common to all, but attitude makes the difference
The opinions expressed above are the personal opinions of the authors, not of Hewlett Packard Enterprise. By using this site, you accept the Terms of Use and Rules of Participation.
News and Events
Support
© Copyright 2024 Hewlett Packard Enterprise Development LP