History of OS Commands

[Deepu Chakravarty]

We have rp7420 with HPUX 11.11 OS server. We want to know what are the OS related commands issued in the server on the command prompt in the last two days. Please advise. Thanks.

[Mark McDonald_2]

Do you have auditing enabled?

If not then this could be impossible.

Check shell history for the users in question.
Check sulog
Check syslog

last | more will show which users logged in, sulog will show if they switched to root.

[Sridhar R]

Hi Deepu,

Below are the links that you can refer.

http://forums11.itrc.hp.com/service/forums/questionanswer.do?threadId=101717

http://forums.itrc.hp.com:80/cm/QuestionAnswer/1,1150,0x3263dfe5920fd5118fef009
0279cd0f9,00.html

http://forums.itrc.hp.com:80/cm/QuestionAnswer/1,1150,0x3263dfe5920fd5118fef009
0279cd0f9,00.html


Thanks & Regards
Sridhar

[Taifur]

Hi Deepu,

Pls run below command & check
#cat /etc/history

Rgds//
Taifur

[Avinash20]

We want to know what are the OS related commands issued in the server on the command prompt in the last two days

>> Without the system being trusted, you could enable history for each and every user

>> You need to configure the history by editing the profile file

>> You could find the list of command executed by the user in .sh_history file under home directory of user if enabled.

history file cannot give time at which it was executed.
Am not sure but writing a script might help.

Else if you could enable auditing you will be able to get all the activity by all the users captured.. noted tat the audit files are huge and require lot of space.

[Mark McDonald_2]

Deepu

Did you find what you needed? How about some points for the answers so far?