Afaik something like that is not being logged right out of the box. You could check the ODM, if there is any kind of timestamp somewhere associated with the appropriate interface (have no AIX to check at the moment), but I quite doubt that. I also doubt it is written to the Error Report, but you can try out that very easy. Error Report is bound to a buffer size and it`s entries will be overwritten, if too many messages go in there.
If you have Auditing (
Accounting and Auditing on AIX 5L) set up you could be lucky to find some traces of any shell input. If not, you could set this up if things like this are in your interesst.
You could also think about to use something to track config changes like
SPM.
There was also an AIX native tool, but I do not remember itīs name. Xray was using it - I will drop him a PM, to help me recall itīs name
If the user had to use
sudo to issue the command, you might be lucky with the sudo logs.
If it was done via smitty, check smitty.log.