Author Topic: Linux Tracking History  (Read 830 times)

0 Members and 1 Guest are viewing this topic.

Offline denbernardo

  • Jr. Member
  • **
  • Posts: 3
  • Karma: 0
  • I've just joined!
    • View Profile
    • Awards
Linux Tracking History
« on: September 12, 2013, 06:57:42 am »
Hi Guys,

Is there a way to backtrack or check all history and activities done in my linux systems.

Ex. check all done command line activity on my server

Thanks in Advance.

Dennis
« Last Edit: September 12, 2013, 09:36:20 am by denbernardo »

Offline Mark Greaves (PCNetSpec)

  • Administrator
  • Hero Member
  • *****
  • Posts: 14454
  • Karma: 357
  • Gender: Male
  • "-rw-rw-rw-" .. The Number Of The Beast
    • View Profile
    • PCNetSpec
    • Awards
Re: Linux Tracking History
« Reply #1 on: September 12, 2013, 10:10:20 pm »
run:
Code: [Select]
history
for the current user .. or check the .bash_history files for other users (in their home folders).

You could also check /var/log/auth.log

or any of the other log files in /var/log

and possibly search the system for "history"
Code: [Select]
locate history
or
Code: [Select]
sudo find / -name *history*
« Last Edit: September 12, 2013, 10:14:14 pm by Mark Greaves (PCNetSpec) »
WARNING: You are logged into reality as 'root'

logging in as 'insane' is the only safe option.

Offline denbernardo

  • Jr. Member
  • **
  • Posts: 3
  • Karma: 0
  • I've just joined!
    • View Profile
    • Awards
Re: Linux Tracking History
« Reply #2 on: September 13, 2013, 02:28:37 am »
Thank you so much Mark,

I did some research and found out psacct tool. On this tool I can see only the command apply on the systems but not full detailed. Did you have any idea that can help.

Ex. mkdir dennis
> I can only see command "mkdir" but not full details including the folder "mkdir dennis"

Again, thanks in advance.

Offline Mark Greaves (PCNetSpec)

  • Administrator
  • Hero Member
  • *****
  • Posts: 14454
  • Karma: 357
  • Gender: Male
  • "-rw-rw-rw-" .. The Number Of The Beast
    • View Profile
    • PCNetSpec
    • Awards
Re: Linux Tracking History
« Reply #3 on: September 13, 2013, 03:49:27 pm »
psacct and acct don't log thwe full command "as entered" .. that would be in the bash_history (as metined above.

They only log the use of a particular command .. see here:
http://www.tecmint.com/how-to-monitor-user-activity-with-psacct-or-acct-tools/
WARNING: You are logged into reality as 'root'

logging in as 'insane' is the only safe option.

Offline denbernardo

  • Jr. Member
  • **
  • Posts: 3
  • Karma: 0
  • I've just joined!
    • View Profile
    • Awards
Re: Linux Tracking History
« Reply #4 on: September 14, 2013, 03:48:23 am »
Thank you so much Mark

Regards,
Dennis

Offline Mark Greaves (PCNetSpec)

  • Administrator
  • Hero Member
  • *****
  • Posts: 14454
  • Karma: 357
  • Gender: Male
  • "-rw-rw-rw-" .. The Number Of The Beast
    • View Profile
    • PCNetSpec
    • Awards
Re: Linux Tracking History
« Reply #5 on: September 14, 2013, 01:04:55 pm »
No problem :)
WARNING: You are logged into reality as 'root'

logging in as 'insane' is the only safe option.

 


SimplePortal 2.3.3 © 2008-2010, SimplePortal