2

On a Mac, or a Linux Tomcat install, how do I determine what user was used last to start Tomcat? Is there information in the logs somewhere to that effect?

Assume that startup.sh and shutdown.sh are being used to control Tomcat. My best guess is the user(s) who have write access to Catalina.out are the most plausible suspects, but I wanted a hard and fast rule for determining who it is. Also it isn't currently running so don't say ps -ef|grep -i Tomcat

3

Check the ownership of the PID file, that's a dead giveaway.

2

Can you:

  • check your system's audit log to see which user ran startup.sh or shutdown.sh?
  • check who owns the log file for each timestamped Catalina.out (if so configured)?
  • auditd is not auditing at that level by default is it? Also, what if the Catalina ownership looks like rwxrwx--- root appserver? That is similar to what it looked like and I couldnt tell if that means they were using root or appserver, thus this question was asked. Granted I consider this server to be a bit misconfigured , but that is a different story. – Gregg Leventhal Dec 17 '13 at 22:21
  • 2
    The default auditd configuration is entirely dependent on the distribution you're running, we can't tell anything beyond "Linux". I would suggest experimenting with your own particular installation to determine the answer. – Pauska Sock Dec 18 '13 at 2:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.