Visit Our UNIX and Linux User Community

tracking user action

Thread Tools Search this Thread
Top Forums UNIX for Advanced & Expert Users tracking user action
# 1  
Old 09-05-2006
tracking user action


we are using solaris8. we have some files disappear. I would like to know how to track who and when the files was remove ???
# 2  
Old 09-05-2006
You could start with users' shell histories.
# 3  
Old 09-05-2006

We have an oracle account and share among admin.
each of us login as individual name, then su - oracle.
Therefore it is hard to know who deleted the files.
Where can I set the history file with more detail of ip address login or time of files was removed.

# 4  
Old 09-05-2006
Couple things you could do:

- You could set an environment that keeps separate shell histories for any user that su's to oracle. Ex: make user oracle's shell ksh, then make .profile writable to root only. In .profile, set HISTFILE to something like .sh_history.$USER. You can script the retrieval of the user name or, something I saw implemented before, you give the users a code they need to enter, which will match their usernames.

You could make the oracle account accessible to only one user at the time. Same deal, whatever .profile or .bashrc, you make writable to root only. Inside, script a check to see if anyone is already su'd to oracle. If so, kill the session. Then you can simply use sulog and the oracle user's shell history.
# 5  
Old 09-05-2006
If you are going to set the .profile ownerships to root, then make sure that you make the oracle home directory root owned, or else anyone can do whatever they want to the file.

A better idea would be to have some sort of rootlogger script using the 'script' command or using one of the many commercially available logging software.
# 6  
Old 09-12-2006
Sounds like you have a problem with users, and privileged user accounts. ie oracle

You could try one of two or both... should look into the possibilities to see if they suit your needs first as they are only suggestions.

You need to get control over the “su” command. Basically stop users “su”ing to privileged accounts.

Modify the /etc/profile (Global system file) to run a script that checks to see if the user requesting to “su” to the privileged account is allowed to...
(I have done this and its dead easy....Only hassle is that the /etc/profile is over written every time you upgrade the OS. Hence you need to replace the code. I used a one liner to over come this.) I may still have the scripts handy, I did it about 5 years ago.. at one site and it really did the trick.

Install “sudo” and you can start to control who can run what command. And sudo has a log file.

Sudo is available on the net, and there's heaps of info as well.

Incorporate the command checking as outlined in the previous replies posted above.
# 7  
Old 09-13-2006
best of all, turn on BSM auditing...but do some research first before using.

Previous Thread | Next Thread
Test Your Knowledge in Computers #256
Difficulty: Easy
MILNET gave birth to NIPRNet, which was used to transmit sensitive but unclassified data between internal users and also provide those users with a gateway to the commercial Internet.
True or False?

9 More Discussions You Might Find Interesting

1. Shell Programming and Scripting

How can i TRAP a user Logout action?

When the temp user logs in i see his session as below. # who root pts/0 2017-08-18 08:32 ( temp pts/1 2017-08-18 09:06 ( root pts/2 2017-08-18 08:59 ( When he logs out by either firing exit command or closing the... (3 Replies)
Discussion started by: mohtashims
3 Replies

2. HP-UX

Tracking what commands were executed after sudo to another user

All team members has sudo access to user "batch55". Need to track all the commands used by team members after sudo to "batch55". Using HP-UX and ksh shell in our environment. How can i acheive this? Thanks In Advance. (2 Replies)
Discussion started by: venkatababu
2 Replies

3. Shell Programming and Scripting

multiple action!

lets explain it easy by showing the initial file and desired file: I've a file such this that contains: initial_file: 31/12/2011 23:46:08 38.6762 43.689 14.16 Ml 3.1 ... (1 Reply)
Discussion started by: oreka18
1 Replies

4. Red Hat

Tracking Process to a particular

I've tried to see what I can find on my own but I'm coming up with goose eggs. Basically I was wondering if there was a way of querying the scheduler (or something similar) to track a process back to a particular CPU it's executing on at the time of the command. ps has a "cpu" output option but... (1 Reply)
Discussion started by: thmnetwork
1 Replies

5. UNIX for Dummies Questions & Answers

Tracking user access

Hi, An important file in my solaris server has been deleted. Is there any way that i can find out when was that file deleted and what user account was used to delete the file.. (1 Reply)
Discussion started by: saharookiedba
1 Replies

6. UNIX for Advanced & Expert Users

Tracking down the problem

Is there a way to track down what process is sending to a certain port? I have some thing pounding the network with requests to a multicast IP that doesn't exist. I have shut down all comms related processes and yet it is still there. Need a way to track the port or IP back to the process. Thanks... (3 Replies)
Discussion started by: mattmanuel
3 Replies

7. UNIX for Advanced & Expert Users

Tracking user

dear all, I'm facing problem that is i have noticed from few days back that some body is deleting and making changes in the file from developement server where i'm working(in unix) so i want to track that who is using the server, what performancr they are doing and each every thing which r... (5 Replies)
Discussion started by: panknil
5 Replies

8. UNIX for Advanced & Expert Users

Command Tracking

Hi, OS: Solaris9, SPARC Is there any way I can track the commands run by users from the shell prompt? Example: Somebody is deleting files from the system. Who it is is a mystery. That person obviously does not use bash prompt so there is no history. Is there anyway I can find out who... (5 Replies)
Discussion started by: mahatma
5 Replies

9. Shell Programming and Scripting

action command

Hi.. When i refered the script /etc/rc.sysinit... i found the "action commands" like But this is not working in my shells.. the following error is coming... Please anybody help Thanks in advance esham (5 Replies)
Discussion started by: esham
5 Replies

Featured Tech Videos