Auditing User administrator Post: 71244

9 More Discussions You Might Find Interesting

1. AIX

User Auditing

i want to audit user commands .. keep track of what commands each user has been giving .. can this be done by writing a script in engraving it in .profile of the user. or is there any other way of doing this ... rgds raj

2. HP-UX

Auditing User's actions

Hi all I hope to find what i'm looking for in this forum as said in the topic i want to track user's actions on the system. i mean also the action of moving or removing files. I have an HP 9000 with HP UX 11i. the users log on the HP from a terminal window under WIndows XP Thx

3. Solaris

add administrator user to system

Hello I have a new job and I need change the last user administrator, I dont know if is easier change some things about this user or add my user in the group with every permission, how can I do it. I dont know which is the group. I think is no only useradd en after modify /etc/passwd. Tank...

4. Shell Programming and Scripting

Script for Oracle user activity auditing

Hi All, I need to put in place a UNIX shell script that calls three sql scripts & reports to the DBAs. I already have the three sql scripts in place & they perform the following database auditing actions: 1. actions.sql This script queries the DBA_AUDIT _TRAIL table to look for database user...

5. Shell Programming and Scripting

user auditing

Hello, is there some way to track what shell commands some user is executing ? Something like to have some log file where i could see what commands some user used, e.g. rm -r dirname , ls -l .... and so on ... I have 2.6.13-1.1526_FC4smp

6. Solaris

Solaris user auditing

Hello, I was wondering when Solaris auditing is enabled, If it is possible to keep track of users that are allowed to sudo to root. In other words, I would like to know which user did what on my Solaris box. (assumig that user can "sudo su -" ) Thanks.

7. AIX

User auditing from AIX server

I am trying to find out the information of my local desktop when i use putty to login to an AIX server. This is what I do: 1. login to my PC 2. take a putty session to an AIX server Can i get information of my local desktop from the AIX server ? Is there a command available ? Thanks

8. UNIX for Beginners Questions & Answers

AIX Administrator - User Profile Management

Good afternoon all, Was un-sure on where to post this so I thought I would use this topic... I was wondering what best practice people use for the deletion of user profiles on AIX systems? At the moment, I currently don't delete any user profiles, they are just disabled as they...

9. UNIX for Beginners Questions & Answers

Create a shell script to gather user account information and displays the result to administrator

I want to create a shell script to gather user account information and displays the result to administrator. I have created a script but its showing all the information when i search for username like: amit@mx:~$ ./uinfo.sh amit Username : amit User Info ...

LEARN ABOUT DEBIAN

aulast

AULAST:(8)						  System Administration Utilities						AULAST:(8)

NAME

       aulast - a program similar to last

SYNOPSIS

       aulast [ options ] [ user ] [ tty ]

DESCRIPTION

       aulast  is  a  program  that prints out a listing of the last logged in users similarly to the program last and lastb. Aulast searches back
       through the audit logs or the given audit log file and displays a list of all users logged in (and out) based on the range of time  in  the
       audit  logs. Names of users and tty's can be given, in which case aulast will show only those entries matching the arguments. Names of ttys
       can be abbreviated, thus aulast 0 is the same as last tty0.

       The pseudo user reboot logs in each time the system is rebooted. Thus last reboot will show a log of all reboots since  the  log  file  was
       created.

       The  main  difference  that  a user will notice is that aulast print events from oldest to newest, while last prints records from newest to
       oldest. Also, the audit system is not notified each time a tty or pty is allocated, so you may not see quite  as  many  records	indicating
       users and their tty's.

OPTIONS

       --bad  Report on the bad logins.

       --extract
	      Write raw audit records used to create the displayed report into a file aulast.log in the current working directory.

       -ffile Use the file instead of the audit logs for input.

       --proof
	      Print  out the audit event serial numbers used to determine the preceding line of the report. A Serial number of 0 is a place holder
	      and not an actual event serial number. The serial numbers can be used to examine the actual audit records in more  detail.  Also	an
	      ausearch query is printed that will let you find the audit records associated with that session.

       --stdin
	      Take audit records from stdin.

EXAMPLES

       To see this month's logins
       ausearch --start this-month --raw | aulast --stdin

SEE ALSO

       last(1), lastb(1), ausearch(8), aureport(8).

AUTHOR

       Steve Grubb

Red Hat 							     Nov 2008								AULAST:(8)