command log accesibility

[pawan agrawal]

Hi

i am using hp-ux 11iv2

i need to have log of all the commands executed on the system for last 48 hrs. along with the userid & time stamp on regular basis. please help me

[Turgay Cavdar]

If you want to see "log of all the commands", then auditing must be enabled on your system with the required system calls.If auditing enabled on your system, you can use "audisp" command to see the audir file.

# /usr/bin/audisp /your_audit_file

[pawan agrawal]

how can i check auditing is enable or not, in my system there is no /usr/bin/audisp directory.

[Turgay Cavdar]

Hi,
Type :
# audsys

You should see "auditing system is currently on"...

[Turgay Cavdar]

The command audisp may be in /usr/sbin directory...

[Johnson Punniyalingam]

>>>>how can i check auditing is enable or not, in my system there is no /usr/bin/audisp directory.<<<<

# audsys
warning: /.secure/etc/audnames does not exist
auditing system is currently off
current file: ** unknown **
next file: ** unknown **
statistics- afs Kb used Kb avail % fs Kb used Kb avail %
current file: ** no data available **
next file: ** no data available **

# ls -l /usr/sbin/*aud*
-r-xr-xr-x 1 bin bin 45056 Aug 26 2004 /usr/sbin/audevent
-r-xr-xr-x 1 bin bin 86016 Jan 30 2006 /usr/sbin/audisp
-r-xr-xr-x 1 bin bin 40960 Sep 3 2003 /usr/sbin/audomon
-r-xr-xr-x 1 bin bin 53248 Aug 26 2004 /usr/sbin/audsys
-r-xr-xr-x 1 bin bin 32768 Aug 26 2004 /usr/sbin/audusr

# uname -a
HP-UX B.11.23 U 9000/800 100901507 unlimited-user license

[pawan agrawal]

auditing is currently off
o/p of root@cmd1#ll /usr/sbin/*aud* is
-r-xr-xr-x 1 bin bin 55524 Aug 27 2004 /usr/sbin/audevent
-r-xr-xr-x 1 bin bin 149076 Jan 31 2006 /usr/sbin/audisp
-r-xr-xr-x 1 bin bin 39492 Sep 3 2003 /usr/sbin/audomon
-r-xr-xr-x 1 bin bin 67932 Aug 27 2004 /usr/sbin/audsys
-r-xr-xr-x 1 bin bin 36892 Aug 27 2004 /usr/sbin/audusr


is there any method by which log of all command executed on system with userid & time for past 48 hour will automatically save in a file

[Dennis Handly]

>Is there any method by which log of all command executed on system with userid & time

Other than auditing, there may be commercial products that do this.

[pawan agrawal]

Hi

can you please provide me detail of any such product.

[Dennis Handly]

>can you please provide me detail of any such product?

If you do a forum search you can find:
http://forums.itrc.hp.com/service/forums/questionanswer.do?threadId=947033
powerbroker

http://forums.itrc.hp.com/service/forums/questionanswer.do?threadId=1386067
http://forums.itrc.hp.com/service/forums/questionanswer.do?threadId=957845
http://forums.itrc.hp.com/service/forums/questionanswer.do?threadId=1064511
http://forums.itrc.hp.com/service/forums/questionanswer.do?threadId=1338794
http://forums.itrc.hp.com/service/forums/questionanswer.do?threadId=813835
http://forums.itrc.hp.com/service/forums/questionanswer.do?threadId=1342438
http://forums.itrc.hp.com/service/forums/questionanswer.do?threadId=1321202
http://forums.itrc.hp.com/service/forums/questionanswer.do?threadId=964003
http://forums.itrc.hp.com/service/forums/questionanswer.do?threadId=1409609
http://forums.itrc.hp.com/service/forums/questionanswer.do?threadId=1401143
http://forums.itrc.hp.com/service/forums/questionanswer.do?threadId=1058502
http://forums.itrc.hp.com/service/forums/questionanswer.do?threadId=1004243
http://forums.itrc.hp.com/service/forums/questionanswer.do?threadId=774672
http://forums.itrc.hp.com/service/forums/questionanswer.do?threadId=217043