How to Track HISTORY of USER Commands Fired ?

[redhat7012]

Hi,

In HP-UX Box, How to track the HISTORY of USER Commands Fired  ?

I tried to use # history command, but its not giving any output.

Please let me know,how to track the history of a User who fired the commands and time the user fired the commands.

Regards,

Aparna.

[Dennis Handly]

You probably have to turn on auditing and if you make sure you have a dedicated filesystem for the massive amounts of data.

[redhat7012]

Don't we have any specific command in HP-UX ,like in LINUX we have HISTORY Command ?

[Patrick Wallek]

The history functionality is available in HP-UX, but it does NOT log the time / date a command was run.

I have seen hacks in the Forums that will put the date in the history file but that can mess up your ability to correctly recall commands.

[redhat7012]

Then, how to track the log file of a user who messed up the server ?

If someone fires commands which can bring the server down, then how to find out that ?

Who has done ?

How can we find it in HP-UNIX BOX ?

Where is the question of security then ?

[Chirag Parikh]

If user is using KORN Shell then you have to add below entry in the .profile file of the user to capture the timestamp of the command fire by user.

Entry will be as below---

set -u # error if undefined variable.
trap "echo 'logout root'" 0

# what to do on exit.
trap 'date "+#%c" | read -s' debug
# timestamp .sh_history
export HISTFILE=/tmp/$LOGNAME`date +%m%d%y%H%M%S` i
# Put it in /tmp
#My .sh_history file
AKA /tmp/$LOGNAME030911134105

Regards,

Chirag Parikh.

[Dennis Handly]

>how to track the log file of a user who messed up the server?

>If someone fires commands which can bring the server down, then how to find out that?

Users can't mess up a server, only sysadmins can.

>Where is the question of security then?

If you force everyone to use sudo, you can log each command.