The tag has no wiki summary.

learn more… | top users | synonyms

16
votes
4answers
768 views

Finding command execution time in hindsight

I've just executed a long-running process from the bash prompt. In hindsight, I wish I'd run time on it, or noted down the time at which I kicked it off. Is there any way of getting this information ...
11
votes
1answer
2k views

How do I monitor opened files of a process in realtime?

I know I can view the open files of a process using lsof at that moment in time on my Linux machine. However, a process can open, alter and close a file so quickly that I won't be able to see it when ...
7
votes
3answers
377 views

Uncover sudoer user with root privileges which ran command X?

I'm the main sysadmin of a system. In the system there are 3 sudoers users with root's privileges. The system runs a script in background which check the hash of system's utilities to detect possible ...
7
votes
2answers
384 views

How do I add network or user source connection data to history entries?

I would like to modify the history settings for all users on the systems that I manage. I would like it to contain the information from the connecting terminal like from who sysadmin:/ # who sysadmin ...
6
votes
2answers
612 views

Is it possible to know who visited my home directory?

Suppose there are many users in a Linux cluster, each of them has his own HOME directory under /home/xxx, with xxx being his user name (or account). If the initial system configuration allows these ...
6
votes
1answer
64 views

Automatic logging of scripts executed by users

That's a recurrent question of my workmates. We are a team of many people which works in the same Unix and Linux servers. The recurrent questions is if there are a log or something similar by default ...
5
votes
1answer
105 views

How do I find the full history of a file?

I need to know the full history of a file, like if someone changed or moved it to some other places since the time when it is created.
5
votes
0answers
96 views

Logging violations of rules in limits.conf [duplicate]

I'm trying to log the details of the programs that where failed due to the limit cap defined in the limits.conf. My initial plan was to do it using the audit system. The idea was to track the system ...
4
votes
2answers
151 views

Understanding getlogin()

I think the previous iteration of this question was a little bit like a carpet bomb of questions, so that may have turned people off to it (to the point of almost being flagged for removal) so I'll ...
4
votes
4answers
174 views

Are commands executed through SSH transparent to a remote host's administrator?

Can administrators know what commands I execute non-interactively through SSH? For example: does echo hello get logged somewhere at remote if I run this? $ ssh me@remote "echo hello" Can remote ...
3
votes
2answers
4k views

Display a file's history (list of users that have modified a file)

Is there a command to display a list of users who modified a file providing a file history? I know that possible with svn/git etc.. but we have a config file that is not in SVN and someone modified ...
3
votes
1answer
54 views

Monitoring Linux user activities and auditing them

var/log/secure provides us below information : Mar 20 08:07:07 testing sshd[29749]: Accepted password for oracle from 10.51.1.12 port 49239 ssh2 Mar 20 08:07:07 testing sshd[29749]: ...
3
votes
1answer
54 views

Root complete history commands

Where can I get root's history except besides .sh_history? I've gotten some information but only from .sh_history and the history command.
3
votes
1answer
88 views

How to interpret the “saddr” field of an audit log?

I'm trying to log the parameter of connect, so I added one rule with auditctl. Now in audit.log I get lines like this: type=SOCKADDR msg=audit(1385638181.866:89758729): saddr=hex string So how ...
3
votes
1answer
321 views

Is there an easy way to log all commands executed, including command line arguments?

I am trying to find how to log a specific instantiation of rrdtool to see whether the path it is receiving is incorrect. I know I could wrap the executable in a shell script that would log the ...
3
votes
1answer
370 views

Commands for Auditing Installed Software

Similar to the question here, http://serverfault.com/questions/387111/inventory-or-audit-installed-linux-software, I would like to obtain ideas about commands that should be ran across various ...
3
votes
0answers
55 views

Is there a tool for seeing audit events as they happen without writing them to the disk?

Linux has an audit system that is usually used together with auditd, a daemon that, as far as I know, is designed for logging all events to the disk. However, I would like a way to directly get the ...
2
votes
2answers
189 views

Logging hidden file creations [duplicate]

Possible Duplicate: Is it possible to find out what program or script created a given file? Can I find somewhere in logs the times of creation of hidden files or directories under the ...
2
votes
2answers
257 views

Log every command typed in any shell: output (from logger function to syslog-ng/journald) contains duplicate entries for commands?

I installed syslog-ng to use on my desktop (Gentoo 64bit, upgraded to systemd i.e. was OpenRC before, with Openbox and Slim only) with my normal user to log all commands I type in the shell (bash ...
2
votes
2answers
84 views

Is there some way to find out if/when an executable was called?

I'm trying to figure out whether AUCTeX is actually calling dvipng when it renders LaTeX previews. While this may not the best way to find this out, one possibility is to check whether the executable ...
2
votes
1answer
479 views

dmesg filled with audits every minute from cron

My dmesg is filled with output of like the following, starting from a couple of seconds after booth and continuing indefinitely: [ 3155.216230] type=1006 audit(1393236841.859:85): pid=4206 uid=0 old ...
2
votes
1answer
215 views

Proper syntax for “id -r” command

I'm trying to see if id -r will print out the UID or username of the user who logged into the system despite any su's or sudo's. I'm interested in doing this so I can keep people a little more ...
2
votes
2answers
30 views

is there a audit tool to track package installs and kernel version

I'm currently diagnosing a problem that started about a week ago on my laptop (running Ubunutu). The exact issue is not relevant though. Because I was already running several locally built kernel ...
2
votes
2answers
184 views

How do I know if acct is running? (The Linux user accounting system)

I have installed the acct package and it is running because I can see file activity in the log file. I know there is the command accton on to turn it on, but how do I determine that its running short ...
1
vote
2answers
108 views

How to determine what user was used to start Apache Tomcat last (or last few times)

On a Mac, or a Linux Tomcat install, how do I determine what user was used last to start Tomcat? Is there information in the logs somewhere to that effect? Assume that startup.sh and shutdown.sh are ...
1
vote
1answer
146 views

Is there a way to see which process invoked a shell script?

Is there a possibility so see from some unix log file what process have invoked a bash/ksh shell script or is this shell script invoked manually from command line? So is there some log file which ...
1
vote
2answers
86 views

Auditing Linux: tell me to what IPs a connection was established

I need a command, or something that runs as a cron job, that logs what IPs my machine is communicating with, what ports, and what process did it.
1
vote
2answers
181 views

How to find responsible script with ausearch results?

So I wanted to know which process is creating a directory ']' in my root. I was assuming this is some typo in some script. So I set up an audit for that directory, very similarly as shown on This ...
1
vote
0answers
36 views

audit activity on abstract domain sockets?

Using the audit system (auditd, auditctl) on Linux, is it possible to log connections to Unix domain sockets on the abstract namespace (or more exactly to filter them based on the (abstract) path)? ...
1
vote
0answers
128 views

AIX auditing for LDAP users

I've discovered a problem with the way AIX uses auditclasses to determine which system calls are audited. If a user is defined in LDAP, their auditclasses attribute is blank. I found an APAR which ...
0
votes
1answer
82 views

(CentOS) default FTP (SFTP) Log File?

I'm on CentOS v6.4 and using its native FTP Server, which i suppose is sftp. (Am i right?) Now i can use FTP well. But i need to log the actions taken by Users. Logs for the actions, such us, who ...
0
votes
1answer
22 views

Auditing of gdb commands

Is there a way I can log all gdb commands executed by a user? And do user level logging? Is any other tool like gdbserver can help in this case ?
0
votes
1answer
108 views

How to Install, Configure and Use LSAT

I saw a tool LSAT that is used for Security auditing of Linux Servers. But found not much material for LSAT. Can someone please provide help of how to Setup Configure Use Lsat
0
votes
0answers
28 views

auditctl reports “File system watches not supported” on a very old system

When I run auditctl -l I got: # auditctl -l No rules File system watches not supported And I've already have AUDITSYSCALL enable in kernel, # zgrep AUDIT /proc/config.gz CONFIG_AUDIT_ARCH=y ...
0
votes
0answers
23 views

What is the purpose of the audit-group and how is it used?

Some Unix-flavors have a group called audit. What is it purpose and how is it used? (What is the audit-system anyway?) Is this a system-group just to run a sub-system, or a group for users thus ...
0
votes
0answers
17 views

audit dir content removing / deletion [duplicate]

Possible Duplicate: Is it possible to find out what program or script created a given file? A peasant needs thunder to cross himself and wonder. A few minutes I get lost wp blog content the ...