file access info

[Henry Chua]

Hi Guys,

Just curious to know, is there anyway I can know when a executable file has been used? and if it was called by another program can I know which program was doing the call?

If not can I write a program to keep any of this future information in a log file, how can this be done?

Thank u

[Muthukumar_5]

You can get the file access information with,

ls -lu

We can find the execution of specific file with history file or system auditing.

hth.

[Henry Chua]

Hi Muthu,

Thank you for the info. Can you elaborate on the latter suggestion? does HPUX has a history or audit application i can utilise in this case. Or should I write a script to do this?

Best regards
Henry

[jpcast_real]

Henry ,

You can enable the auditory in the server . However I prefer to create a centralized store for all the histories of every user .

I have introduced in my /etc/profiles

USER1=`id -nu`
USER2=`who am i | awk '{print $1}'`
tty=`who am i | awk '{ print $2 }'`
FROM=`who -a | grep -i $tty | awk '{print $NF }'`
SCREEN=`who -u -m | awk '{ print $NF }'| sed 's/:/ /g' | awk '{ print $1 }'`
export DISPLAY=$SCREEN:0.

TTYTEMP=`tty`
TTY=`basename $TTYTEMP`
FECHA=`date +%d%b%Y`
HORA=`date +%H%M%S`
export HISTFILE=/.history/${USER1}-${USER2}.${TTY}.${FECHA}.${HORA}
export PS1=`hostname`':$PWD> '
EDITOR=vi
export $EDITOR

It creates a history for each user in a "hidden" folder

[Devender Khatana]

Hi,

For history we export these two lines in /etc/profile for all users or for a indivisual user in his .profile.

export HISTFILE="/path_to_file/$LOGNAME"
export HISTSIZE=1000

Here /path_to_file directory should be writable by user for which you are exporting history.
This will create a file with user name in this directory.

HTH,
Devender

[Muthukumar_5]

We can get the history of each user information with /etc/profile setting as,

set -o $EDITOR
HISTFILE=$HOME/.sh_history_$LOGNAME_$(date +'%d-%m-%y_%X')
HISTSIZE=1000

so that it will create history information in users home page with .sh_history_(login name_ date_time)


If you want to audit the user command execution then you have turn your system into trusted one.

You have to use /usr/lbin/tsconvert utility to do it or using sam also u can do it.

hth.

[Henry Chua]

Hi Javier,

Thank you for the info.. actually my problem is that a program (say X) running on my workstation seems to behave strangely, as it is an object files, i can't see their content. But I seriouly will like to know which program running on the background is executing X and when the execution is being carried out? Can this be done?

Best regards
Henry

[Muthukumar_5]

X process will be startup process for the session so that you can it with who -u. IF some is using x windows who -u will give that command. Process ID will be in that execution.

hth.

[Devesh Pant_1]

Henry,
try to find the pid of the original x session that starts then you can do a grep for the pid that is running the x program.
ps -ef| grep pid

This will give you quite a few.
if you want a specific filesystem details,
you can do a
fuser -c /var
and that will give you all the pids accessing any files on say /var
Try to match the pid of your original x program or it's children to the list you just got from fuser.

Devesh