Sponsored Content
Full Discussion: AIX audit users activity
Operating Systems AIX AIX audit users activity Post 302125013 by kah00na on Tuesday 3rd of July 2007 11:34:36 AM
Old 07-03-2007
You could also specify their history file in the /etc/profile with a few lines like these:

HISTSIZE=10000
mkdir -p $HOME/.history
HISTFILE=$HOME/.history/.history.$(date +%Y%m%d.%H%M%S).$$

This would keep 10,000 events in a uniquely named history files with the date they logged in included in the name of the file.
 

10 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

logging users activity

Hello All! Does anyone know of a nice way to log commands in solaris 8. What I need is a program or script that saves any command that a user does in solaris command prompt. So when Steven logs in on a system, it should record everything he does, from an ls to exit with timestamps. I've been... (6 Replies)
Discussion started by: dozy
6 Replies

2. UNIX for Dummies Questions & Answers

audit user activity - possible?

Hi, I have been asked if it is possible to track the last time a specific user logged in to the sysetm. checked my documentation but can't see it there - google is not being very helpful either. I wonder if someone here can help - it will be much appreciated. Thanks Suresh (1 Reply)
Discussion started by: sureshy
1 Replies

3. SCO

Commands for review users activity

:D Hi, I'm searching for a command or commands to see the user and programs activity and who much resources is in use. In Unix I remember a TOP command but in SCO I'm don't find a similar. My system is a UNIX SCO 5.6 Thank's (1 Reply)
Discussion started by: DigitalExecutiv
1 Replies

4. Solaris

I need to audit users on a Solaris box

Is there a command to find out all the commands ran by a certain user id? TiA (5 Replies)
Discussion started by: PapaPark
5 Replies

5. AIX

turn on audit for all users

hi all, the audit /etc/security/audit/config file is only referring one user at a time. how do you specify all users to be monitored? I've tried ALL = general but got error when invoke "audit start". thanks (1 Reply)
Discussion started by: itik
1 Replies

6. AIX

Aix high cpu activity

Hello everyone I have this process running on my server. topas command User 98.6 |############################ I have this process Name PID CPU% PgSp Owner db2fm 565264 25.6 1.5 ldapdb2 db2fm 348328 23.6 ... (4 Replies)
Discussion started by: lo-lp-kl
4 Replies

7. UNIX for Advanced & Expert Users

audit user commands of different users under root account

Hi, I would like to know if there is anyway that I can pinpoint the user before/after he connects to the root? Also, I'm trying to find out what are the commands he inputs under root access. (6 Replies)
Discussion started by: pointgetter0
6 Replies

8. Red Hat

Loggin SFTP activity for chrooted (rssh) users

Hi, I need to log the activity of my SFTP (RHEL 5.4). I have this in /etc/sshd/sshd_config: Subsystem sftp /usr/libexec/openssh/sftp-server -f LOCAL5 -l VERBOSE And this in /etc/syslog.conf: LOCAL5.* /var/log/sftp.log When I log in... (1 Reply)
Discussion started by: Tr0cken
1 Replies

9. AIX

When AIX audit start, How to set the /audit/stream.out file size ?

Dear All When I start the AIX(6100-06)audit subsystem. the log will save in /audit/stream.out (or /audit/trail), but in default when /audit/stream.out to grow up to 150MB. It will replace the original /audit/stream.out (or /audit/trail). Then the /audit/stream.out become empty and... (2 Replies)
Discussion started by: nnnnnnine
2 Replies

10. Shell Programming and Scripting

Audit user activity

Need some help in coming up to log all the activity that is used with our common "unix account". Ideally I am looking for to log the activity in a "separate" file for each session or login until the user logout, I would like to capture the date/time and terminal login and record all the ... (3 Replies)
Discussion started by: rajmanna
3 Replies
history(n)						       Tcl Built-In Commands							history(n)

__________________________________________________________________________________________________________________________________________________

NAME
history - Manipulate the history list SYNOPSIS
history ?option? ?arg arg ...? _________________________________________________________________ DESCRIPTION
The history command performs one of several operations related to recently-executed commands recorded in a history list. Each of these recorded commands is referred to as an ``event''. When specifying an event to the history command, the following forms may be used: [1] A number: if positive, it refers to the event with that number (all events are numbered starting at 1). If the number is negative, it selects an event relative to the current event (-1 refers to the previous event, -2 to the one before that, and so on). Event 0 refers to the current event. [2] A string: selects the most recent event that matches the string. An event is considered to match the string either if the string is the same as the first characters of the event, or if the string matches the event in the sense of the string match command. The history command can take any of the following forms: history Same as history info, described below. history add command ?exec? Adds the command argument to the history list as a new event. If exec is specified (or abbreviated) then the command is also exe- cuted and its result is returned. If exec isn't specified then an empty string is returned as result. history change newValue ?event? Replaces the value recorded for an event with newValue. Event specifies the event to replace, and defaults to the current event (not event -1). This command is intended for use in commands that implement new forms of history substitution and wish to replace the current event (which invokes the substitution) with the command created through substitution. The return value is an empty string. history clear Erase the history list. The current keep limit is retained. The history event numbers are reset. history event ?event? Returns the value of the event given by event. Event defaults to -1. history info ?count? Returns a formatted string (intended for humans to read) giving the event number and contents for each of the events in the history list except the current event. If count is specified then only the most recent count events are returned. history keep ?count? This command may be used to change the size of the history list to count events. Initially, 20 events are retained in the history list. If count is not specified, the current keep limit is returned. history nextid Returns the number of the next event to be recorded in the history list. It is useful for things like printing the event number in command-line prompts. history redo ?event? Re-executes the command indicated by event and return its result. Event defaults to -1. This command results in history revision: see below for details. HISTORY REVISION
Pre-8.0 Tcl had a complex history revision mechanism. The current mechanism is more limited, and the old history operations substitute and words have been removed. (As a consolation, the clear operation was added.) The history option redo results in much simpler ``history revision''. When this option is invoked then the most recent event is modified to eliminate the history command and replace it with the result of the history command. If you want to redo an event without modifying history, then use the event operation to retrieve some event, and the add operation to add it to history and execute it. KEYWORDS
event, history, record Tcl history(n)
All times are GMT -4. The time now is 10:38 PM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy