how to find out system activity

[siva baskaran]

Dear,

actually i have faced one problem by user( who is soft Admin), particular service (soft service) has been terminated by some user( root rights) at particular time (like 11:00 AM) now i should find out who has done it, so how to find out system activity at particular time

and how to list out particular process has been run at particular time

becuase of i couldn't able to findout by syslog new & old

is any cmds to findout ?

thanks
siva

[Chan 007]

Sar will give your system activity report.

sulog will provide you who did su (best way to find who did at 11:00AM)

.sh_history will provide what all actiity did by at person who did su at 11:00AM.

Other way check the user's .sh_history at their home directory..!!

Chan

[Senthil Kumar .A_1]

Hi,

/usr/sbin/acct/fwtmp < /var/adm/wtmp | more

The above command will give you the details of exactly who logged in at what time. As far as the system activity is concerned, you had be lucky if process accounting was logged in your system.

Regards,
Senthil Kumar .A

[Prashant Zanwar_4]

you can ask system to track performance using a script, or man 1m sadc, or third party tool..

id you dont have sadc configured to collect data, then you wont come to know what statistics it was going thru at particular time..

just add few commands to ur cron and make it possible to see stats

also similarly you can plan some sctipt, might be itrc forums you can find some to track or log statistics on system..

Thanks
Prashant

[Steven E. Protter]

Shalom,

Check the root cron schedule for jobs including the kill command.

A particular time. That is the evidence left behind by a machine.

crontab -l

carefully look at stuff running at 11 a.m.

SEP