1
vote
1answer
31 views

Who is user “unset” in aureport?

I couldn't find this elusive "unset" user in /etc/passwd and there is no mention of him in man aureport although she scored the most number of hits on my audit log: # aureport -u -i --summary --start ...
2
votes
1answer
36 views

How to extract a list of user accounts deleted from the system over a period of 1 year? [closed]

I'm auditing an AIX and a Linux system and I would like to know how many user accounts were created and deleted over a 1 year period. Is there some way of getting this data from the Unix system?
1
vote
1answer
56 views

Unix Useradd - Audit list of users added to system [duplicate]

I would like to understand how could I pull out a list of users that have been added with certain privileges to a Unix system over a certain period of time. Now, I understand one way to go about ...
1
vote
2answers
185 views

How to determine what user was used to start Apache Tomcat last (or last few times)

On a Mac, or a Linux Tomcat install, how do I determine what user was used last to start Tomcat? Is there information in the logs somewhere to that effect? Assume that startup.sh and shutdown.sh are ...
4
votes
2answers
229 views

Understanding getlogin()

I think the previous iteration of this question was a little bit like a carpet bomb of questions, so that may have turned people off to it (to the point of almost being flagged for removal) so I'll ...
7
votes
2answers
531 views

How do I add network or user source connection data to history entries?

I would like to modify the history settings for all users on the systems that I manage. I would like it to contain the information from the connecting terminal like from who sysadmin:/ # who sysadmin ...