We suspect that one of our CentOS server has been compromised because someone left a filesystem mounted accidentally (its an old empty partition we don't use anymore, in a home/unusual_name directory name. We think someone mounted it to check what's inside and forgot to dismount)

No mount command trace in .bash_history nor /var/log/messages.

We have several login auditories so we can use those timestamps to know if we can catch who left that filesystem mounted, but how can we know when that filesystem was mounted?


  • 4
    This may be of some help: superuser.com/a/152645/441365 – Andrew Henle Jan 9 '17 at 17:41
  • What do you mean by "home/unusual_name directory"? – Thomas Jan 9 '17 at 17:42
  • @AndrewHenle Thanks a lot! I tried to search that with no results. – vegatripy Jan 9 '17 at 17:53
  • @Thomas I mean a directory with an name out of our particular directories hierarchy. He/she named /root/tmpdir ... – vegatripy Jan 9 '17 at 18:03

As Andrew Henle commented, this was already answered in this superuser.com question:

Finding out the time a filesystem was last mounted

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.