I'm auditing an AIX and a Linux system and I would like to know how many user accounts were created and deleted over a 1 year period. Is there some way of getting this data from the Unix system?

  • Look in the logs, obviously. What gets logged if anything, and how long the logs are kept, depends on the unix variant and local configuration. At least tell us which unix variant this is, and we can answer for the default configuration. – Gilles 'SO- stop being evil' Sep 13 '14 at 23:24
  • Thanks Gilles, but could you be a little more specific as to which log file I should be looking at and what kind of text I should be searching for in the log files. – QuickMist Sep 16 '14 at 5:46
  • The log file depends on the unix variant, which you hadn't told us until now. Which Linux distribution? – Gilles 'SO- stop being evil' Sep 16 '14 at 6:04
  • The Linux variant is CentOS. – QuickMist Sep 16 '14 at 6:12
  • Please edit your question to mention the AIX version, and ask a separate question for CentOS (better mention the version as well). – Gilles 'SO- stop being evil' Sep 16 '14 at 14:10

I was experimenting with a ubuntu machine for trying to find a solution for you. When you create a user and delete it and then create a user again, the second user takes the uid of the deleted user so it s hard to find the amount of users by this technic.

I suppose there is no command for your willing actions.

I think you re going to find your answer by doing some forensic stuff on your machine and try to see the paths of every deleted file and figure out the user who created or deleted the file.

I hope there is someone who can answer your question with more theory about this section of unix machines.

  • Hi Christos. Does unix keep some log somewhere which I can use or correlate to get this information? – QuickMist Sep 12 '14 at 13:09

Not the answer you're looking for? Browse other questions tagged or ask your own question.