04-05-2004
3,093,
36
Join Date: Apr 2002
Last Activity: 28 March 2019, 4:00 PM EDT
Location: On my motorcycle
Posts: 3,093
Thanks Given: 2
Thanked 36 Times in 11 Posts
If you are not running accounting, then you will have a hard time figuring out what processes were running - even if you do have accounting it may be difficult.
You can check out some of the following which may show some information.
last - you can tell who physcially signed into the system (by account) but not what they ran.
syslog - check if syslogd is running on server - then check /etc/syslog.conf to see where it's placing it's information - one file it may put it in is the /var/adm/messages file - this will contain errors/warnings/info
/var/adm/sa/* - you may or may not have files in this directory if sar is running - will give performance of server but not processes running.
If you give more information on what you are looking for, it may be easier for us to point you in the right direction.