Online Expert Day - HPE Data Storage - Live Now
April 24/25 - Online Expert Day - HPE Data Storage - Live Now
Read more
cancel
Showing results for 
Search instead for 
Did you mean: 

find out all user

prateek_1
Advisor

find out all user

I need to find out all user who logged in my host and what modification they done.
16 REPLIES
Ganesan R
Honored Contributor

Re: find out all user

Hi,

Need more details. If you need to know the currently logged in users use #who -u command or #w

If you have enabled auditing you can findout which user did what.
Best wishes,

Ganesh.
Sani
Frequent Advisor

Re: find out all user

Hi ,

use "whodo" to find out logged in users and process running by those users.

Regards
Sani
prateek_1
Advisor

Re: find out all user

I need all user currently as well as previously logged on system and in which file they done any modification with the IP address of user.
T G Manikandan
Honored Contributor

Re: find out all user

What version of HPUX you are running, you need to convert your system to a trusted mode to enable auditing to find all information.
Johnson Punniyalingam
Honored Contributor

Re: find out all user

Hi Prateek,

Have you turn on audting in your Server .?

If you Server Trusted System.? if not bit difficult... :(

# last -R user1 user2 user3

(above command will give login history with IP address of user1,user2,user3)

Hope This Helps,

Tks,
Johnson
Problems are common to all, but attitude makes the difference
Robert-Jan Goossens
Honored Contributor

Re: find out all user

Prateek,

You need to have a look at the system audit tools. I don't know what versionof HPUX you are running, but have a look at the below link and search for audit.

http://h20392.www2.hp.com/portal/swdepot/searchProducts.do

Regards,
Robert-Jan
prateek_1
Advisor

Re: find out all user

Hi,
how can i turn on audting in my Server,commands mentioned by you give me o/p like--
bash-2.05# last -R user1 user2

WTMPS_FILE begins at Thu Jan 29 19:42:29

prateek_1
Advisor

Re: find out all user

im using 11.31 sep08 fusion.
Ganesan R
Honored Contributor

Re: find out all user

Hi Prateek,

Use SAM to convert the system into trusted mode. Once you converted to trusted you can enable auditing.

SAM -> Auditing and Security ->Goto Actions ->Convert the sytem
Best wishes,

Ganesh.
Fred Ruffet
Honored Contributor

Re: find out all user

Turning system into trusted mode may not be done to fast. It may have side effects that need to be studied.

Regards,

Fred
--

"Reality is just a point of view." (P. K. D.)
prateek_1
Advisor

Re: find out all user

Thanks ganesan ,now i m able convert the system into trusted mode.

but above command are giving same o/p--

bash-2.05# last -R user1 user2

WTMPS_FILE begins at Thu Jan 29 19:42:29

i need to find out the ip of user and check where and what changes he/she had done.

Fred Ruffet
Honored Contributor

Re: find out all user

The "last" command will only tell you who logged in, from which IP and at which time. But it won't tell you what action has been made. If it's a shell action, you will have information in the .sh_history file of the user (if it exists).

Regards,

Fred


--

"Reality is just a point of view." (P. K. D.)
Jeeshan
Honored Contributor

Re: find out all user

duplicate thread has been opened. close one

http://forums11.itrc.hp.com/service/forums/questionanswer.do?threadId=1316984
a warrior never quits
prateek_1
Advisor

Re: find out all user

sure ahsan,
prateek_1
Advisor

Re: find out all user

Hi fred ,

.sh_history is not here but i can see some previous command on .bash_histroy.but its difficult to me to specify which command used by which user.could you help me on that
Duncan Edmonstone
Honored Contributor

Re: find out all user

Is this something you need to do going forward, or are you actiavely trying to determine a change that someone has made in the past?

If the latter, it sounds to me like its too late. Enabling auditing won't show you what happened *before* auditing was enabled! Only what has happened since it was enabled.

A couple of other points:

i) Don't convert to a trusted system... hou don't need to to enable autiting in 11iv3(11.31). In fact trusted systems will be deprectaed in a future release.

ii) If you really wanto to setup auditing correctly I suggest you *read and understand* the section of the manual that covers this:

http://docs.hp.com/en/5992-3387/ch10.html

It really isn't as simple as running a couple of commands and magically getting what you want. You bhave to take ther time to decide what you're going to audit and then configure collection and manage the ongoing production of audit logs...

HTH

Duncan

HTH

Duncan