03-23-2010
Seems like noone has the answer...
I ended up with a solution like sharing NFS share, and aggregating audit trails there. Not the most elegant solution - but it works.
We`re waiting for the PSARC/2009/208 - sending audit logs to remote system to take it`s way into production!
10 More Discussions You Might Find Interesting
1. UNIX for Advanced & Expert Users
Hello Unix Champs,
For keeping audit trail, I want to log the commands entered by the normal users, on their terminal into a text file.
I tried putting a "script -a username.timestamp.txt" in the user profile file, but script command stops execution when user types exit or presses CTRL+D... (3 Replies)
Discussion started by: bhaven.haria
3 Replies
2. Solaris
Hi Friends,
I am trying to execute rsh commands from Solaris 10 system to AIX system.
When I give;
Solaris10# rsh <hostname> ls -l , it gives me an error
rshd : 0826-826 The host name for your address is not known
At the same time,
Solaris10# rsh <hostname> ---- gives me remote shell of... (25 Replies)
Discussion started by: jumadhiya
25 Replies
3. Solaris
Hi all
I want to know the commands executed a by particular user .. for the whole day on my machine.
I have checked out with the commad
$lastcomm <user>
It is throwing an error called: ..
/var/adm/pacct: No such file or directory
Can u help me in this regard..
Thank U
Naree (1 Reply)
Discussion started by: naree
1 Replies
4. UNIX for Dummies Questions & Answers
Hi all,
I am new to unix OS.
Commands(external commands) given by the user are examined by shell and later executed by kernel.
Now I want to know how the internal(built in) commands are executed.
Please clarify whether they are executed directly by shell or by kernel.
Thanks in... (2 Replies)
Discussion started by: chaitra
2 Replies
5. Shell Programming and Scripting
Hi,
I have executed a set of commands on the linux server and later rebooted the server. Is it possible to get the details of the commands I executed prior to the reboot? If yes please let me know how?
Thanks. (1 Reply)
Discussion started by: yoursdavinder
1 Replies
6. UNIX for Dummies Questions & Answers
how to execute more than one command at the same time in unix .. (4 Replies)
Discussion started by: hemaa
4 Replies
7. Shell Programming and Scripting
Dear friends,
Whenever I do logout from a session initiated by ssh/su, I need to print a small report which says the login time, logout time, commands got executed..
How can it be done?
I know when doing ssh, .profile file will get executed. Shall we do something with the help of it. (1 Reply)
Discussion started by: nagalenoj
1 Replies
8. UNIX for Dummies Questions & Answers
Hi,
I have cleared the commands by using >$HOME/.sh_history.
But if i issue HISTORY it shows some reference numbers but not the commands executed.
But i want to truncate those line numbers too.
May i know how i can achieve this?
Thanks (1 Reply)
Discussion started by: pandeesh
1 Replies
9. Shell Programming and Scripting
Hi guys,
I am executing a pretty long ksh script and need to time stamp every command which runs inside.
Unfortunatly 'echo date' is not the option here.
May be someone knows another way or utility which can be used to log executed command and timestamp next to it.
Thanks
PS I work in ksh88 (4 Replies)
Discussion started by: aoussenko
4 Replies
10. UNIX for Dummies Questions & Answers
Hi All, how to list all the commands executed by users on a linux server.... I dont have access to others .bash_history. and i am not root user.. Please help.. Thanks in advance.. (6 Replies)
Discussion started by: nanz143
6 Replies
LEARN ABOUT DEBIAN
aulast
AULAST:(8) System Administration Utilities AULAST:(8)
NAME
aulast - a program similar to last
SYNOPSIS
aulast [ options ] [ user ] [ tty ]
DESCRIPTION
aulast is a program that prints out a listing of the last logged in users similarly to the program last and lastb. Aulast searches back
through the audit logs or the given audit log file and displays a list of all users logged in (and out) based on the range of time in the
audit logs. Names of users and tty's can be given, in which case aulast will show only those entries matching the arguments. Names of ttys
can be abbreviated, thus aulast 0 is the same as last tty0.
The pseudo user reboot logs in each time the system is rebooted. Thus last reboot will show a log of all reboots since the log file was
created.
The main difference that a user will notice is that aulast print events from oldest to newest, while last prints records from newest to
oldest. Also, the audit system is not notified each time a tty or pty is allocated, so you may not see quite as many records indicating
users and their tty's.
OPTIONS
--bad Report on the bad logins.
--extract
Write raw audit records used to create the displayed report into a file aulast.log in the current working directory.
-ffile Use the file instead of the audit logs for input.
--proof
Print out the audit event serial numbers used to determine the preceding line of the report. A Serial number of 0 is a place holder
and not an actual event serial number. The serial numbers can be used to examine the actual audit records in more detail. Also an
ausearch query is printed that will let you find the audit records associated with that session.
--stdin
Take audit records from stdin.
EXAMPLES
To see this month's logins
ausearch --start this-month --raw | aulast --stdin
SEE ALSO
last(1), lastb(1), ausearch(8), aureport(8).
AUTHOR
Steve Grubb
Red Hat Nov 2008 AULAST:(8)