Question for all sysadmins.
How do you keep track of what commands each user uses on his account. I thought an easy way is to monitor .bash_history, however those files can be "edited" by the user.
Is there a permission combination that will allow the shell to record to it but yet they can't edit... (12 Replies)
During the course of the session before I logout I see some of the commands listed from my previous session but not from my current session and after I logout and log back in I see the commands which I ran before logging out.
Does the .bash_history stay in the buffer or someplace else then?
... (2 Replies)
Dear All,
I am creating users on our servers. the .bash_history supposed to store all the commands entered by the user. My question is, how can I prevent the user himself from editing or viewing this file?
I have tried chaning the owner of the .bash_history to be the root user but... (5 Replies)
Hi Experts,
I know my question would be strange but i need to understand how the .bash_history file is logging user actions (the mechanism) and if possible modify it to include also the date/time of every action done by the user.
Sample file:
# more .bash_history
ssh <IP address> -l axadmin... (3 Replies)
Hi - user commands are written in . bash_history of that user when he logs out. my bash_history file shows. not sure what that number means
#1329618972
ls -la
#1329618978
ls
#1329618980
ls -la
my bash_profile looks like this
PATH=$PATH:$HOME/bin
export PATH
export... (3 Replies)
I have 100 files in a directory , all the files have a word "error" and they are created in different date . Now I would like to change the word from "error" to "warning" , and keep the date of the files ( that means do not change the file creation date after change the word ) , can advise what can... (7 Replies)
rm -rf .bash_history some one ran rm -rf .bash_history on my Linux server(SUSE),I can see this command being run in current history, but I want the OLD history as well,can I recover the old history back. (9 Replies)
Hi would like to ask if there is anyway to display .bash_history with timestamp using shell script?
i know that you should use history command with HISTTIMEFORMAT="%d/%m/%y %T " to display it in terminal but it does not work when i use it on shell script. It seem that you can't run history... (1 Reply)
Hello
I'm trying to virtualize an instance of Sco Unix 5.0.5 in VirtualBox (called VM-A) , but sco I have problems set to launch with the new raid controller .
The physical machine has a raid controller adaptec (alad driver) but VirtualBox uses buslogic (blc driver)
What ... (3 Replies)
I am using the bash shell.
When I view my recent command history using the "history" command from the prompt, it only shows me the commands starting at #928.
The commands I need are earlier than that, but I can't figure out how to make the other 927 display.
They are in my .bash_history... (1 Reply)
Discussion started by: Twinklefingers
1 Replies
LEARN ABOUT OSX
syscallbyproc.d
syscallbyproc.d(1m) USER COMMANDS syscallbyproc.d(1m)NAME
syscallbyproc.d - syscalls by process name. Uses DTrace.
SYNOPSIS
syscallbyproc.d
DESCRIPTION
syscallbyproc.d is a DTrace OneLiner to a report of the number of system calls made by process name.
This is useful to identify which process is causing the most system calls.
Docs/oneliners.txt and Docs/Examples/oneliners_examples.txt in the DTraceToolkit contain this as a oneliner that can be cut-n-paste to run.
Since this uses DTrace, only users with root privileges can run this command.
EXAMPLES
This samples until Ctrl-C is hit.
# syscallbyproc.d
FIELDS
first field
This is the process name. There may be several PIDs that have the same process name, for example with numerous instances of "bash".
The value reported will be the sum of them all.
second field
This is the count, the number of system calls made.
DOCUMENTATION
See the DTraceToolkit for further documentation under the Docs directory. The DTraceToolkit docs may include full worked examples with ver-
bose descriptions explaining the output.
EXIT
syscallbyproc.d will sample until Ctrl-C is hit.
AUTHOR
Brendan Gregg [Sydney, Australia]
SEE ALSO procsystime(1M), dtrace(1M), truss(1)version 1.00 May 15, 2005 syscallbyproc.d(1m)