user activity log

[cch_1]

my system (HPUX) is not a trusted/ audited system.
But i would like to retrieve a user activity log ( other than the shell history file )

Is that any clues or any areas I can trace the user activity ?
thank you.

[RAC_1]

You have very limited options without trusted system/audited system and .sh_history file.

Look at man page of script. But these files grow very fast.

[Arunvijai_4]

Hello,

You can do it by setting up history command,

In user's .profile, add the following line
HISTFILE=$HOME/.sh_history ; export HISTFILE

-Arun

[cch_1]

Thank you. I have already enabled history in my system.

Other than shell history, what can I do in order to trace the user activity in 1-2days ago ?

[Arunvijai_4]

Hello,

Check your system log files, /var/adm/syslog/syslog.log , OLDsyslog.log, mail.log.

-Arun

[Cem Tugrul · Accepted solution]

Hello,

Here are some links may help to you;

http://forums1.itrc.hp.com/service/forums/bizsupport/questionanswer.do?threadId=218820

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=109749

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=740203

Good luck,

[Devender Khatana]

Hi,

The commands are listed in the history file as mentioned earlier. You can see that and also use history command.

#history -1000

There are no other footprints available by default.

HTH,
Devender

[Nguyen Anh Tien]

each user has his/her own history file. It located at ~.sh_history by default!

[rariasn]

Hi cch,

Modify /etc/profile, and add,

DATE=`date +%d_%b_%o_%a_%R:%S`
DEST=`hostname`
ORI=`who -R am i | awk '{print $6}' | cut -c2- | cut -f1 -d ')'`
mkdir -p $HOME/.historicos
HISTFILE=$HOME/.historicos/$DATE.$DEST.$ORI.$LOGNAME.txt
export HISTFILE
HISTSIZE=16384
export HISTSIZE