remsh

[rveri]

Hi All ,

If a command has executed through remsh from another server to my local server, is there any way to find out , which command executed and what time it was excuted.

examle:
server2:# remsh server1 "/fin23d/script31.sh "

So does any log can be found on server1 for this command that executed from server2.


thanks,

[Ninad_1]

Hi,

I have seen entries in /var/adm/syslog/syslog.log for commands executed from remote server. The entries were like
Sep 4 23:20:34 server1 rshd[20089]: ROOT shell from root@srv2.mydomain, comm: rcp -t /var/stats.dir/tmp
Sep 4 23:22:46 server1 rshd[20264]: ROOT shell from root@srv3.mydomain, comm: /usr/sbin/ioscan -fn
Sep 4 23:24:18 server1 rshd[20405]: ROOT shell from root@srv3.mydomain, comm: who -b
Sep 4 23:24:18 server1 rshd[20408]: ROOT shell from root@srv3.mydomain, comm: uptime


Regards,
Ninad

[Ludovic Derlyn]

hi,

If you execute command "last" on server , you can see just connection

for example :

# last
root pts/0 Mon May 29 17:08 - 17:11 (00:02)
root pts/tb Mon May 29 11:52 - 17:11 (05:19)
root console Mon May 29 11:29 - 11:31 (00:01)
root console Mon May 29 10:50 - 10:59 (00:08)
root ftp Mon May 29 10:33 - 10:33 (00:00)
root ftp Mon May 29 10:33 - 10:33 (00:00)
root ftp Mon May 29 10:33 - 10:33 (00:00)

If you want take a trace, see command "script" who enregister session

script "filename"

regards