Sponsored Content
Operating Systems AIX Bullet proof of user history activity Post 302278420 by Browser_ice on Tuesday 20th of January 2009 07:22:42 AM
Old 01-20-2009
Question Bullet proof of user history activity

Hi, is there a bullet proof of getting the history of all commands entered by a user on a specific server and idealy with the times ?

We have several servers. Therefore we can simply logon to one and do RLOGINS to go to others. We always first logon to servers with our personnal login and then switch to root. From there we can either work directly or switch to a few other users. We have the option of connecting to another server using RLOGIN (but with first being root as we don`t have to enter passwords on the rlogined server).

I have to find out if a specific employee did some work over the weekend as it is causing major escalation pain.

I am not sure if just doing a ROOT> HISTORY -999 is safe enough to check the activity of any users on one specific server no matter how they connected to it.

[added comments]
I just remembered that someone here once retrieved every single screen outputs that was done on one specific server including command prompt. Maybe that is what I need but don't recall how he did it.

We are using /bin/ksh shell by the way and AIX v4.2

Last edited by Browser_ice; 01-20-2009 at 08:28 AM..
 

9 More Discussions You Might Find Interesting

1. UNIX for Advanced & Expert Users

Force user to disconnect if no activity

Does anybody know how to force a user to automatically logoff a UNIX session if there is no keyboard activity for a period of time? We use COBOL and there is a BEFORE TIME option on the ACCEPT command, however, we do not want to change the many programs we have to detect this. What we really... (3 Replies)
Discussion started by: MarkN
3 Replies

2. UNIX for Dummies Questions & Answers

audit user activity - possible?

Hi, I have been asked if it is possible to track the last time a specific user logged in to the sysetm. checked my documentation but can't see it there - google is not being very helpful either. I wonder if someone here can help - it will be much appreciated. Thanks Suresh (1 Reply)
Discussion started by: sureshy
1 Replies

3. Shell Programming and Scripting

SVN activity of certain user

Hi there, I'm looking for some help to get a little script done that shows me (or counts) only the added lines from an SVN repository of one specific user. Anybody has an idea? Thanks, Michael (0 Replies)
Discussion started by: MichaelGiese
0 Replies

4. UNIX for Dummies Questions & Answers

Commands to monitor other user's activity

What commands would you recommend in order to monitor things like when a user logs on to a server, assuming you know that user's name on the server? (2 Replies)
Discussion started by: Sotau
2 Replies

5. UNIX for Advanced & Expert Users

History to Another file [local user history , but root access]

Hi all, My need is : 1. To know who , when , which command used. 2. Local user should not delete this information. I mean , with an example , i can say i have a user user1 i need to give all the following permissions to user1, : a. A specific directory other than his home... (3 Replies)
Discussion started by: linuxadmin
3 Replies

6. UNIX for Dummies Questions & Answers

History to Another file [local user history , but root access]

Hi all, My need is : 1. To know who , when , which command used. 2. Local user should not delete this information. I mean , with an example , i can say i have a user user1 i need to give all the following permissions to user1, : a. A specific directory other than his home... (1 Reply)
Discussion started by: sriky86
1 Replies

7. Shell Programming and Scripting

Audit user activity

Need some help in coming up to log all the activity that is used with our common "unix account". Ideally I am looking for to log the activity in a "separate" file for each session or login until the user logout, I would like to capture the date/time and terminal login and record all the ... (3 Replies)
Discussion started by: rajmanna
3 Replies

8. UNIX for Dummies Questions & Answers

How to track user activity?

Hi All Please can you help me with the following issue: A certain vendor installed an application in which for a user to log in; the user must use a user created/predefined by the application. And because this application has more than one user its difficult to track who did what and when,... (6 Replies)
Discussion started by: fretagi
6 Replies

9. UNIX for Advanced & Expert Users

Track activity of a user

Hi All We have a job which writes files to a server at a particular time. The files will be created by a particular user ID Today, during the execution of the job, it created a file to the server and the file sat on the server for sometime, but was deleted immediately at the end of the... (4 Replies)
Discussion started by: sparks
4 Replies
history(n)						       Tcl Built-In Commands							history(n)

__________________________________________________________________________________________________________________________________________________

NAME
history - Manipulate the history list SYNOPSIS
history ?option? ?arg arg ...? _________________________________________________________________ DESCRIPTION
The history command performs one of several operations related to recently-executed commands recorded in a history list. Each of these recorded commands is referred to as an "event". When specifying an event to the history command, the following forms may be used: [1] A number: if positive, it refers to the event with that number (all events are numbered starting at 1). If the number is negative, it selects an event relative to the current event (-1 refers to the previous event, -2 to the one before that, and so on). Event 0 refers to the current event. [2] A string: selects the most recent event that matches the string. An event is considered to match the string either if the string is the same as the first characters of the event, or if the string matches the event in the sense of the string match command. The history command can take any of the following forms: history Same as history info, described below. history add command ?exec? Adds the command argument to the history list as a new event. If exec is specified (or abbreviated) then the command is also exe- cuted and its result is returned. If exec is not specified then an empty string is returned as result. history change newValue ?event? Replaces the value recorded for an event with newValue. Event specifies the event to replace, and defaults to the current event (not event -1). This command is intended for use in commands that implement new forms of history substitution and wish to replace the current event (which invokes the substitution) with the command created through substitution. The return value is an empty string. history clear Erase the history list. The current keep limit is retained. The history event numbers are reset. history event ?event? Returns the value of the event given by event. Event defaults to -1. history info ?count? Returns a formatted string (intended for humans to read) giving the event number and contents for each of the events in the history list except the current event. If count is specified then only the most recent count events are returned. history keep ?count? This command may be used to change the size of the history list to count events. Initially, 20 events are retained in the history list. If count is not specified, the current keep limit is returned. history nextid Returns the number of the next event to be recorded in the history list. It is useful for things like printing the event number in command-line prompts. history redo ?event? Re-executes the command indicated by event and returns its result. Event defaults to -1. This command results in history revision: see below for details. HISTORY REVISION
Pre-8.0 Tcl had a complex history revision mechanism. The current mechanism is more limited, and the old history operations substitute and words have been removed. (As a consolation, the clear operation was added.) The history option redo results in much simpler "history revision". When this option is invoked then the most recent event is modified to eliminate the history command and replace it with the result of the history command. If you want to redo an event without modifying his- tory, then use the event operation to retrieve some event, and the add operation to add it to history and execute it. KEYWORDS
event, history, record Tcl history(n)
All times are GMT -4. The time now is 04:03 PM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy