Accounting question

[Krishnan Viswanathan]

If I execute the acct command (/usr/sbin/acct/acctcom pacct) I get some data, but I dont see what file the user has removed. Is there an option to check the argument after the commands ?

COMMAND START END REAL CPU MEAN
NAME USER TTYNAME TIME TIME (SECS) (SECS) SIZE(K)
date cbadmin ? 12:00:06 12:00:06 0.04 0.03 0.00
grep cbadmin ? 12:00:06 12:00:06 0.02 0.02 0.00
awk cbadmin ? 12:00:06 12:00:06 0.04 0.03 0.00
rm cbadmin ? 12:00:06 12:00:06 0.12 0.03 0.00

Thanks
Krishnan

[S.K. Chan]

I'm almost sure there is no option that you asked for. Even with "-u " option it does not show command parameter. After all you would want to use other means to get that information. For example, .sh_history file of an individual user.

[Helen French]

Iyer,

Not sure whether this helps you, but take a look at this guide. I have not seen any option for a detail command options, as you needed:

http://www.docs.hp.com/hpux/onlinedocs/B2355-90129/B2355-90129.html

HTH,
Shiju

[Krishnan Viswanathan]

Thanks guys. My problem is I am seeing that a user has executed a rm command.
But I dont know which files/directory he has removed.
Is there a specific option in the "acctcom" command ?

The shell history of the specific user wont help since a) the history is limited b) some users delete their history

[S.K. Chan]

Might or might not be the answer you're looking for.

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0xe74cded2442ed5118fef0090279cd0f9,00.html

[James R. Ferguson]

Hi:

I think that you're stuck with the simple command name. The arguments thereto are not recorded. Have a look at '/usr/include/sys/acct.h' and/or the man pages for 'acct' [ man 4 acct ].

Regards!

...JRF...