Command Tracking


 
Thread Tools Search this Thread
Top Forums UNIX for Advanced & Expert Users Command Tracking
# 1  
Old 04-03-2006
Command Tracking

Hi,

OS: Solaris9, SPARC

Is there any way I can track the commands run by users from the shell prompt?

Example:
Somebody is deleting files from the system. Who it is is a mystery. That person obviously does not use bash prompt so there is no history. Is there anyway I can find out who is doing it by recording the user commands some where. Is this already done in Solaris?

Regd,
M...
# 2  
Old 04-03-2006
this is one possible idea/suggestion,

have a stealth wrapper to your /usr/bin/rm and /usr/sbin/unlink commands

stealth wrapper.
when the commands rm or unlink is executed first the wrapper which contains the underlying base command would be executed.
With that you can log the userid, file being deleted, time of deletion.

its actually you are wrapper script executed first upon invoking rm or unlink system calls. Then the wrapper in turn executes the required command.

This should give you a clue/option to proceed.
# 3  
Old 04-03-2006
Quote:
Is there any way I can track the commands run by users from the shell prompt?
Yeah, there is a way to do that: convert your system into 'trusted' one, look at man pages for bsmconv and google about how it works, there is also a good and funny tool called ttysnoop (if im not mistaken) which sniff/display user command in realtime ... but never tried both Smilie
Or
hack the shell ... well if u dare Smilie
# 4  
Old 04-04-2006
Thanks for the replies, both-of-you.

I will try them and get back.

So Matrixmadhan; Your suggestion is that I create wrapper files (say shell scripts) called 'rm' and 'unlink' which inturn contains the rm and unlink commands with a logger?

M...
# 5  
Old 04-04-2006
Hi,
There is a command called script which will record all the commanda a user executes.Put this command in the glabal .profile so that each users commands are recorded.
NOTE:
script command saves all dialog in file. If no
file name is given, the typescript is saved in the file typescript.

So pass teh argumnet to script coammnd as a file name created based on user id say

script -a
script logfile.${USERNAME}

This will append all commands to ths logfile.Not sure where the file gets created. Pls see the man page for the same.

Thanks.
# 6  
Old 04-04-2006
Quote:
This will append all commands to ths logfile.Not sure where the file gets created. Pls see the man page for the same.

the file gets created in the directory from you execute the command,
if it is getting executed from your profile then it is obviously the user's home directory.

But you have some subtle points to be noted when using script command.
a) the file gets created in the home directory so the user has an option of corrupting the file anytime
one way of handling this is use script -a <path>
where files are continously taken backup from the path
b) script command is implemented using pseudo master-terminal system so you are not working on the teletype granted to you by login program; you have the control on the line you are working, so one who is playing with that can easily identify from tty and ps -ef | grep login commands whether he is working on a abstraction of script command or in plain teletype line
c) you need to execute exit command twice to logout; that gives a hint to be careful the next time the user logs in

these are the things you need to consider when you are using script command to track.
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. Shell Programming and Scripting

Tracking users through history command

Hi folks, I have the basic query that there are 3 unix boxes having their individual access now in my team there are 4 members who are using the same credentials to access those 3 boxes through putty ssh from their windows desktop , now if i want to check which 4 members have executed the... (1 Reply)
Discussion started by: punpun66
1 Replies

2. Shell Programming and Scripting

Tracking process via ps command

Hello folks, I am tracking a process httpd only. But when i am grepping it, it is returning me multiple process of httpd, second it is showing another process of monitorix-httpd. Below commands i have tried. Current output # ps ax |grep http 929 ? Ss 0:00 monitorix-httpd... (5 Replies)
Discussion started by: learnbash
5 Replies

3. Red Hat

Tracking Process to a particular

I've tried to see what I can find on my own but I'm coming up with goose eggs. Basically I was wondering if there was a way of querying the scheduler (or something similar) to track a process back to a particular CPU it's executing on at the time of the command. ps has a "cpu" output option but... (1 Reply)
Discussion started by: thmnetwork
1 Replies

4. AIX

Tracking Root commands

Hi All How can track what commands are entered by the Root user. Is there a log besides using the history command that lists all commands entered for a period of time. thanks:o (6 Replies)
Discussion started by: pashan
6 Replies

5. IP Networking

netfilter connection tracking

hi, i'm using tcpreplay to send a traffic trace to my wireless interface (the trace is been captured by the same interface). It seems as netfilter can't trace connections. Is it possible? (0 Replies)
Discussion started by: littleboyblu
0 Replies

6. UNIX for Dummies Questions & Answers

tracking root users

Hi everyone hope you can help me i have 5 root users and the problem with that is how can you see witch root user did what on the box how can you track the users that played on the servers. 1) What commands they typed (in linux you get history ) 2) From witch ip did they connect to the server (3 Replies)
Discussion started by: sucram
3 Replies

7. Shell Programming and Scripting

server load tracking

I have written a script which checks server load and emails me. I am running into the error: ./load_alert.sh: line 8: ; then printf "WARNING - cpu load high in xyz server" fi (2 Replies)
Discussion started by: vsmurali
2 Replies

8. UNIX for Advanced & Expert Users

Tracking down the problem

Is there a way to track down what process is sending to a certain port? I have some thing pounding the network with requests to a multicast IP that doesn't exist. I have shut down all comms related processes and yet it is still there. Need a way to track the port or IP back to the process. Thanks... (3 Replies)
Discussion started by: mattmanuel
3 Replies

9. UNIX for Advanced & Expert Users

Tracking user

dear all, I'm facing problem that is i have noticed from few days back that some body is deleting and making changes in the file from developement server where i'm working(in unix) so i want to track that who is using the server, what performancr they are doing and each every thing which r... (5 Replies)
Discussion started by: panknil
5 Replies

10. UNIX for Advanced & Expert Users

tracking user action

Hi, we are using solaris8. we have some files disappear. I would like to know how to track who and when the files was remove ??? thanks, (7 Replies)
Discussion started by: xitrum
7 Replies
Login or Register to Ask a Question