The tag has no wiki summary.

learn more… | top users | synonyms

1
vote
0answers
14 views

File path in audit log instead of inode number

When I do: echo "#TEST" >> /etc/passwd I get the following in audit logging: node=kayak.office.local type=SYSCALL msg=audit(1412687666.054:62033): arch=c000003e syscall=2 success=yes ...
0
votes
1answer
41 views

automatically copy file from local server to remote server after login over ssh

I need to know how to copy a file from local server to remote server automatically after login using ssh. actually In my local server so many users are there with their local userid . but they will ...
1
vote
1answer
33 views

Who is user “unset” in aureport?

I couldn't find this elusive "unset" user in /etc/passwd and there is no mention of him in man aureport although she scored the most number of hits on my audit log: # aureport -u -i --summary --start ...
0
votes
0answers
19 views

third party linux auditing software

Linux has a audit system built-in in its kernel and a user space process called auditd reading the system calls intercepted by the kernel. Are there alternate solutions to the Linux Audit system ? I ...
2
votes
1answer
36 views

How to extract a list of user accounts deleted from the system over a period of 1 year? [closed]

I'm auditing an AIX and a Linux system and I would like to know how many user accounts were created and deleted over a 1 year period. Is there some way of getting this data from the Unix system?
4
votes
1answer
100 views

Why do I get “Permission Denied” errors even though I have group permission?

I'm trying to run a game called "Dofus", in Manjaro Linux. I've installed it with packer, that put it under /opt/ankama folder. This folder ownership (and for every file inside it) is root user, and ...
3
votes
1answer
52 views

Recover atime after vim

I've vimed a file, and only afterwards realised that I need the atime (last access time) for the file. Is there any way to recover the atime for a file after accessing it inadvertently? The ...
1
vote
1answer
56 views

Unix Useradd - Audit list of users added to system [duplicate]

I would like to understand how could I pull out a list of users that have been added with certain privileges to a Unix system over a certain period of time. Now, I understand one way to go about ...
2
votes
1answer
81 views

Bandwith Usage in OpenVPN

Is there any way to check how much bandwidth a user used in OpenVPN (using PAM Authentication)
1
vote
0answers
48 views

What config changes are being tracked by aureport?

I am interested in using aureport to audit my server. When I run: # aureport -c It gives the following output: =================================== # date time type auid success event ...
5
votes
1answer
219 views

How do I view executables run by a program?

Is there a way to view or get a list of executables that a program uses? A particular example is file-roller. Is there a way to see which executables it uses, if there is more than one executable it ...
3
votes
1answer
384 views

Monitoring Linux user activities and auditing them

var/log/secure provides us below information : Mar 20 08:07:07 testing sshd[29749]: Accepted password for oracle from 10.51.1.12 port 49239 ssh2 Mar 20 08:07:07 testing sshd[29749]: ...
2
votes
2answers
82 views

is there a audit tool to track package installs and kernel version

I'm currently diagnosing a problem that started about a week ago on my laptop (running Ubunutu). The exact issue is not relevant though. Because I was already running several locally built kernel ...
0
votes
1answer
3k views

(CentOS) default FTP (SFTP) Log File?

I'm on CentOS v6.4 and using its native FTP Server, which i suppose is sftp. (Am i right?) Now i can use FTP well. But i need to log the actions taken by Users. Logs for the actions, such us, who ...
2
votes
1answer
901 views

dmesg filled with audits every minute from cron

My dmesg is filled with output of like the following, starting from a couple of seconds after booth and continuing indefinitely: [ 3155.216230] type=1006 audit(1393236841.859:85): pid=4206 uid=0 old ...
2
votes
0answers
83 views

audit activity on abstract domain sockets?

Using the audit system (auditd, auditctl) on Linux, is it possible to log connections to Unix domain sockets on the abstract namespace (or more exactly to filter them based on the (abstract) path)? ...
2
votes
2answers
1k views

Log every command typed in any shell: output (from logger function to syslog-ng/journald) contains duplicate entries for commands?

I installed syslog-ng to use on my desktop (Gentoo 64bit, upgraded to systemd i.e. was OpenRC before, with Openbox and Slim only) with my normal user to log all commands I type in the shell (bash ...
3
votes
1answer
182 views

Root complete history commands

Where can I get root's history except besides .sh_history? I've gotten some information but only from .sh_history and the history command.
6
votes
1answer
104 views

Automatic logging of scripts executed by users

That's a recurrent question of my workmates. We are a team of many people which works in the same Unix and Linux servers. The recurrent questions is if there are a log or something similar by default ...
1
vote
2answers
188 views

How to determine what user was used to start Apache Tomcat last (or last few times)

On a Mac, or a Linux Tomcat install, how do I determine what user was used last to start Tomcat? Is there information in the logs somewhere to that effect? Assume that startup.sh and shutdown.sh are ...
4
votes
2answers
175 views

How to interpret the “saddr” field of an audit log?

I'm trying to log the parameter of connect, so I added one rule with auditctl. Now in audit.log I get lines like this: type=SOCKADDR msg=audit(1385638181.866:89758729): saddr=hex string So how ...
0
votes
1answer
53 views

auditctl reports “File system watches not supported” on a very old system

When I run auditctl -l I got: # auditctl -l No rules File system watches not supported And I've already have AUDITSYSCALL enable in kernel, # zgrep AUDIT /proc/config.gz CONFIG_AUDIT_ARCH=y ...
5
votes
1answer
106 views

How do I find the full history of a file?

I need to know the full history of a file, like if someone changed or moved it to some other places since the time when it is created.
5
votes
0answers
96 views

Logging violations of rules in limits.conf [duplicate]

I'm trying to log the details of the programs that where failed due to the limit cap defined in the limits.conf. My initial plan was to do it using the audit system. The idea was to track the system ...
1
vote
1answer
190 views

Is there a way to see which process invoked a shell script?

Is there a possibility so see from some unix log file what process have invoked a bash/ksh shell script or is this shell script invoked manually from command line? So is there some log file which ...
4
votes
1answer
1k views

Is there an easy way to log all commands executed, including command line arguments?

I am trying to find how to log a specific instantiation of rrdtool to see whether the path it is receiving is incorrect. I know I could wrap the executable in a shell script that would log the ...
3
votes
2answers
248 views

How do I know if acct is running? (The Linux user accounting system)

I have installed the acct package and it is running because I can see file activity in the log file. I know there is the command accton on to turn it on, but how do I determine that its running short ...
7
votes
3answers
604 views

Uncover sudoer user with root privileges which ran command X?

I'm the main sysadmin of a system. In the system there are 3 sudoers users with root's privileges. The system runs a script in background which check the hash of system's utilities to detect possible ...
4
votes
4answers
298 views

Are commands executed through SSH transparent to a remote host's administrator?

Can administrators know what commands I execute non-interactively through SSH? For example: does echo hello get logged somewhere at remote if I run this? $ ssh me@remote "echo hello" Can remote ...
2
votes
2answers
118 views

Is there some way to find out if/when an executable was called?

I'm trying to figure out whether AUCTeX is actually calling dvipng when it renders LaTeX previews. While this may not the best way to find this out, one possibility is to check whether the executable ...
3
votes
0answers
64 views

Is there a tool for seeing audit events as they happen without writing them to the disk?

Linux has an audit system that is usually used together with auditd, a daemon that, as far as I know, is designed for logging all events to the disk. However, I would like a way to directly get the ...
4
votes
2answers
231 views

Understanding getlogin()

I think the previous iteration of this question was a little bit like a carpet bomb of questions, so that may have turned people off to it (to the point of almost being flagged for removal) so I'll ...
1
vote
2answers
96 views

Auditing Linux: tell me to what IPs a connection was established

I need a command, or something that runs as a cron job, that logs what IPs my machine is communicating with, what ports, and what process did it.
3
votes
2answers
372 views

Proper syntax for “id -r” command

I'm trying to see if id -r will print out the UID or username of the user who logged into the system despite any su's or sudo's. I'm interested in doing this so I can keep people a little more ...
1
vote
2answers
262 views

How to find responsible script with ausearch results?

So I wanted to know which process is creating a directory ']' in my root. I was assuming this is some typo in some script. So I set up an audit for that directory, very similarly as shown on This ...
0
votes
1answer
24 views

Auditing of gdb commands

Is there a way I can log all gdb commands executed by a user? And do user level logging? Is any other tool like gdbserver can help in this case ?
0
votes
0answers
17 views

audit dir content removing / deletion [duplicate]

Possible Duplicate: Is it possible to find out what program or script created a given file? A peasant needs thunder to cross himself and wonder. A few minutes I get lost wp blog content the ...
6
votes
2answers
818 views

Is it possible to know who visited my home directory?

Suppose there are many users in a Linux cluster, each of them has his own HOME directory under /home/xxx, with xxx being his user name (or account). If the initial system configuration allows these ...
1
vote
0answers
168 views

AIX auditing for LDAP users

I've discovered a problem with the way AIX uses auditclasses to determine which system calls are audited. If a user is defined in LDAP, their auditclasses attribute is blank. I found an APAR which ...
0
votes
2answers
2k views

How to find last deleted files on OpenSuse?

I didn't lock the screen on my OpenSuse Linux and let my girlfriend do all evil things when I was sleeping. Is there a way to find out if she deleted any files from my PC? I was looking at the "Date ...
13
votes
1answer
3k views

How do I monitor opened files of a process in realtime?

I know I can view the open files of a process using lsof at that moment in time on my Linux machine. However, a process can open, alter and close a file so quickly that I won't be able to see it when ...
17
votes
4answers
1k views

Finding command execution time in hindsight

I've just executed a long-running process from the bash prompt. In hindsight, I wish I'd run time on it, or noted down the time at which I kicked it off. Is there any way of getting this information ...
3
votes
2answers
9k views

Display a file's history (list of users that have modified a file)

Is there a command to display a list of users who modified a file providing a file history? I know that possible with svn/git etc.. but we have a config file that is not in SVN and someone modified ...
4
votes
1answer
511 views

Commands for Auditing Installed Software

Similar to the question here, http://serverfault.com/questions/387111/inventory-or-audit-installed-linux-software, I would like to obtain ideas about commands that should be ran across various ...
2
votes
2answers
279 views

Logging hidden file creations [duplicate]

Possible Duplicate: Is it possible to find out what program or script created a given file? Can I find somewhere in logs the times of creation of hidden files or directories under the ...
7
votes
2answers
535 views

How do I add network or user source connection data to history entries?

I would like to modify the history settings for all users on the systems that I manage. I would like it to contain the information from the connecting terminal like from who sysadmin:/ # who sysadmin ...