12-21-2011
Unfortunately the audit file contains entries which show login times for 8th september 2011 and this incident happened a week back, so we are unable to deduce anything from it.
9 More Discussions You Might Find Interesting
1. UNIX for Dummies Questions & Answers
Hi..
I am new to unix. And I am trying to learn more about admin part of it. We have come across a situation where one of the directory gets deleted everyday at 4:00 pm by some process. We are unable to find out what deletes that directory, seems like a automated job.. but there is nothing... (9 Replies)
Discussion started by: vipas
9 Replies
2. UNIX for Dummies Questions & Answers
Hi,
I need to compare todays file to yesterdays file to find deletes.
I cannot use comm -23 file.old file.new.
Because each record may have a small change in it but is not really a delete.
I have two delimited files. the first field in each file is static. All other fields may change. I... (2 Replies)
Discussion started by: eja
2 Replies
3. UNIX for Dummies Questions & Answers
Is there a command or shell script which can be used for Finding all files created by a specified userid in a directory and its subdirectories.
Say, I want to find all such files in directory /abc as well as in all the subdirectories such as /abc/xyz or /abc/xyz/pqr aqnd so on which was created... (5 Replies)
Discussion started by: abhilashnair
5 Replies
4. Cybersecurity
Hi,
I am trying to write a script which would figure out who has run which command and their IP. As i dont have any clue as to which commands would do this job, i request some gurus to help me on this.
Thanks
Vishwas (2 Replies)
Discussion started by: loggedout
2 Replies
5. UNIX for Dummies Questions & Answers
:) Firstly Hi all!!, im NEW!! and on here hoping that someone might be able to offer me some help... i have a server that keeps crashing every few days with the error message:
PANIC KERNAL-MODE ADDRESS FAULT ON USER ADDRESS 0X14
KERNAL PAGE FAULT FROM (CS:EIP)=(100:EF71B5BD)
EAX=EF822000... (10 Replies)
Discussion started by: Twix
10 Replies
6. AIX
Recently we've had a couple user accounts mysteriously disappear. Is there any way to track these accounts and determine who/how they were deleted? (2 Replies)
Discussion started by: Sk0glund
2 Replies
7. Shell Programming and Scripting
Good morning everybody,
I'm using Minix and I want to find the user with less number of files in the system
I have tried this solution:
#! /bin/sh
indice=0
listaCut=$(cut -f 3 -d : /etc/passwd)
for USER in $listaCut; do
cont=0
listaFind=$(find / -user "${USER}" -type -f)
... (4 Replies)
Discussion started by: Guccio
4 Replies
8. Shell Programming and Scripting
I have been searching, and cannot find an answer for this. I am trying to find all files for a user, lets call him (test001), and I want to exclude a specific directory.
Here is the command I run, it finds all files:
find / -user test001
I get this result:
> find / -user test001 ... (4 Replies)
Discussion started by: steve2x4
4 Replies
9. UNIX for Dummies Questions & Answers
Hello
I have user directories that contain /temp directory.
Example folders:
/user1/temp/
/user2/temp/
/user3/temp/
How can i loop over all user directories and find all files only in their /temp folder?
Thanks a lot for help! (3 Replies)
Discussion started by: flavius42
3 Replies
AULAST:(8) System Administration Utilities AULAST:(8)
NAME
aulast - a program similar to last
SYNOPSIS
aulast [ options ] [ user ] [ tty ]
DESCRIPTION
aulast is a program that prints out a listing of the last logged in users similarly to the program last and lastb. Aulast searches back
through the audit logs or the given audit log file and displays a list of all users logged in (and out) based on the range of time in the
audit logs. Names of users and tty's can be given, in which case aulast will show only those entries matching the arguments. Names of ttys
can be abbreviated, thus aulast 0 is the same as last tty0.
The pseudo user reboot logs in each time the system is rebooted. Thus last reboot will show a log of all reboots since the log file was
created.
The main difference that a user will notice is that aulast print events from oldest to newest, while last prints records from newest to
oldest. Also, the audit system is not notified each time a tty or pty is allocated, so you may not see quite as many records indicating
users and their tty's.
OPTIONS
--bad Report on the bad logins.
--extract
Write raw audit records used to create the displayed report into a file aulast.log in the current working directory.
-f file
Use the file instead of the audit logs for input.
--proof
Print out the audit event serial numbers used to determine the preceeding line of the report. A Serial number of 0 is a place holder
and not an actual event serial number. The serial numbers can be used to examine the actual audit records in more detail. Also an
ausearch query is printed that will let you find the audit records associated with that session.
--stdin
Take audit records from stdin.
EXAMPLES
To see this month's logins
ausearch --start this-month --raw | aulast --stdin
SEE ALSO
last(1), lastb(1), ausearch(8), aureport(8).
AUTHOR
Steve Grubb
Red Hat Nov 2008 AULAST:(8)