File auditing - UNIX for Dummies Questions & Answers

aladdin · #1 (**permalink**) 12-20-2006

Hello everbody:
I have a file on the system, I need to check who was the last user who accessed or modified it, and if i can get any further details i can get like IP or access time,etc.
do you have any idea about simple concept or way i can do that in unix tru64 or solaris 9?
thanks in advance guys

ghostdog74 · #2 (**permalink**) 12-20-2006

i guess you have to turn on BSM in solaris. check
here

auditd · #3 (**permalink**) 02-22-2007

Quote:

Originally Posted by aladdin

Hello everbody:
I have a file on the system, I need to check who was the last user who accessed or modified it, and if i can get any further details i can get like IP or access time,etc. do you have any idea about simple concept or way i can do that in unix tru64 or solaris 9?
thanks in advance guys

You can get this information by enabling auditing and configuring the system to use the fm flag. It will give you information about who modified the file, when it was modified, where the user connected from, plus a lot of other information.

If you want to see when users read a file, you need to use the audit flag fr.

More UNIX and Linux Forum Topics You Might Find Helpful
Thread	Thread Starter	Forum	Replies	Last Post
solaris BSM and Auditing	skywalker850i	UNIX for Dummies Questions & Answers	18	03-02-2008 05:22 PM
turning auditing on AIX 4.3	itik	AIX	1	11-20-2007 12:07 AM
User Auditing	rajesh_149	AIX	2	08-22-2005 11:37 PM
BMS Auditing	BlueKalel	SUN Solaris	0	05-11-2005 07:29 AM
System Auditing	Cameron	UNIX for Dummies Questions & Answers	2	01-03-2002 03:04 AM

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode