Find who execute command in a server

[msmystic]

Hello,

I am currently doing an audit to a server. I would like find a history like who run/execute certain commands in the server. May I know which dir should I look at, or any tips can be share since I'm not really familiar into this auditing stuff?

[MK_J]

You would first require to enable auditing in the server and then define policy as per your site requirement.

You can define policy to audit  selected events for success, for failure, or both.

Also, which users and events need to be audited,  based on the site policy.

Following white paper defines how to configure and manage Auditing in HP-UX 11i v2 and 11i v3 :

https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=emr_na-c02899022

Note that you cannot get historical data if auditing was not enabled in the server.

Audit logs get populated only after enabling auditing in the sever. 

You may log a case with HPE support if you have any specific issue with system audit.

Regards,

MJ