In the "/var/adm/ssh_logins" you will find all the executions of SSH done from your server with UIDs of the users running them. You should be able to easily grep the line that you need. After you have identified that user, you can kill dtrace process.
Thank you so much! This looks like what I need but unfortunately it requires root permissions which I do not have Anyway I have suexec permissions with grep...any way I can accomplish this with grep? I'm not familiar with dtrace but after googling it it appears to be rather complex...so I'm guessing I'd probably have to do much more than grepping to find this information?
Hi. I would like to be able to deny IP address for too many failed login attemps (either from ssh, sftp, ftp, etc). The system I wish this to work on is an AIX 5.1 system. I'm new to AIX but I'm a linux user. There is a program for linux called fail2ban which reads from the log files and see if... (1 Reply)
Hi,
I have created the below ftp script to put files over to our capacity server, the check at the end works if ftp fails to run however if the script cannot login or the transfer itself failed there is no warnings.
Does anyone know the syntax to trap the erorr codes or to put a check within... (3 Replies)
Hi,
I have a linux redhat 9 server and I am concerned about the security on that server.
I would like to be able to write a script that records all the commands that were typed at the command prompt before the user calls the 'history -c' command and deletes all the history.
I was thinking about... (4 Replies)
Dear experts,
I am seeing a lot of TCP failed connection attempts from "netstat -s" on one of our servers.
How can I pin point what connection failed and what are the ports involved?
Any tools/commands I can dig in deeper to diag. what went wrong on these "failed connection attempts"?
... (2 Replies)
I have two log files from two different days and some jobs start on one day and finish on the next. I also have jobs that start and then don't finish until other jobs start and finish. I'm trying to create a csv file with job name, start time and end time in the order that the jobs started.
... (2 Replies)
Hi All
I am having VxVm on two Solaris hosts. host1 is using disk group dgHR. right now this server went down due to hardware fault. Not I need to import this dgHR into host2 server. Please let me know the procedure for the same. (1 Reply)
The purpose of this thread is for everyone to follow the same methodology so we can create a future table, for the benefit of all, that shows how many failed login attempts (hacking) per day per server (and per minute) are happening.
This is not a thread on writing scripts or creating... (10 Replies)
Discussion started by: Neo
10 Replies
LEARN ABOUT MOJAVE
lastwords
lastwords(1m) USER COMMANDS lastwords(1m)NAME
lastwords - print syscalls before exit. Uses DTrace.
SYNOPSIS
lastwords command
DESCRIPTION
This prints the last few system calls for processes matching the given name, when they exit. This makes use of a ring buffer so that the
impact on the system is minimised.
Since this uses DTrace, only users with root privileges can run this command.
EXAMPLES
Catch last few syscalls for dying netscape processes,
# lastwords netscape
FIELDS
TIME time of syscall return, ns
PID process ID
EXEC process name (execname)
SYSCALL
system call
RETURN return value for the system call
ERR errno for the system call
BASED ON
/usr/demo/dtrace/ring.d
DOCUMENTATION
DTrace Guide "Buffers and Buffering" chapter (docs.sun.com)
See the DTraceToolkit for further documentation under the Docs directory. The DTraceToolkit docs may include full worked examples with ver-
bose descriptions explaining the output.
EXIT
lastwords will sample until a command with that name exits.
SEE ALSO dtruss(1M), dtrace(1M)version 0.70 Jun 08, 2005 lastwords(1m)
01-22-2012
Anyway I have suexec permissions with grep...any way I can accomplish this with grep? I'm not familiar with dtrace but after googling it it appears to be rather complex...so I'm guessing I'd probably have to do much more than grepping to find this information?