Solved

Last commands

Posted on 2004-08-30
13
332 Views
Last Modified: 2013-12-27
I can't remember the right command, how do you look to see what the last commands that was run by certain users.
am on a solais 9 box.

Thanks,
0
Comment
Question by:bt707
  • 7
  • 4
  • 2
13 Comments
 
LVL 57

Expert Comment

by:Pete Long
ID: 11930148
history | more
Show the last (1000 or so) commands executed from the command line on the current account. The | more causes the display to stop after each screen fill.

0
 
LVL 57

Expert Comment

by:Pete Long
ID: 11930165
NAME
     lastcomm - display the last commands  executed,  in  reverse
     order



SYNOPSIS
     lastcomm [ command-name ] ... [ user-name ] ...
          [ terminal-name ] ...



DESCRIPTION
     The lastcomm command gives information  on  previously  exe-
     cuted  commands.  lastcomm with no arguments displays infor-
     mation about all the commands recorded  during  the  current
     accounting  file's  lifetime.   If  called  with  arguments,
     lastcomm only displays accounting entries  with  a  matching
     command-name, user-name, or terminal-name.

     If terminal-name is `- -' there was no controlling  TTY  for
     the  process.  The process was probably executed during boot
     time.  If terminal-name is `??', the controlling  TTY  could
     not be decoded into a printable name.



EXAMPLES
     The command:
          example% lastcomm a.out root term/01

     produces a listing of all the executions of  commands  named
     a.out, by user root while using the terminal term/01.

     The command:
          example% lastcomm root

     produces a listing of all  the  commands  executed  by  user
     root.

     For each process  entry,  lastcomm  displays  the  following
     items of information:

          o  The command name under which the process was called.

          o  One or more  flags  indicating  special  information
             about  the  process.   The  flags have the following
             meanings:

               F  The process performed a fork but not an exec.

               S  The process ran as a set-user-id program.

          o  The name of the user who ran the process.

          o  The terminal which the user was logged in on at  the
             time (if applicable).

          o  The amount of CPU  time  used  by  the  process  (in
             seconds).

          o  The date and time the process exited.

http://www.biostat.wisc.edu/cgi-bcg/man.cgi?section=all&topic=lastcomm
0
 
LVL 45

Expert Comment

by:sunnycoder
ID: 11930170
Hi bt707,

login as that user and use history command

history

Sunnycoder
0
 
LVL 45

Expert Comment

by:sunnycoder
ID: 11930183
PeteLong,

that was faaaaast ... sorry

Sunnycoder
0
 
LVL 57

Expert Comment

by:Pete Long
ID: 11930197
or look at that user's command history (in ~user/.history).
0
 
LVL 57

Expert Comment

by:Pete Long
ID: 11930204
:) no need to appologise - its not often I get a shot at a solaris Q :)
0
What Should I Do With This Threat Intelligence?

Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

 

Author Comment

by:bt707
ID: 11930210
I do use the last | more command, but that only tells who loged in and what time, does not show what commands was used.

Sunnycoder, i have root rights but do you have to login as that user and use the history command, i thought there was a way to do that without being loged in as a user.

Thanks
0
 
LVL 57

Accepted Solution

by:
Pete Long earned 300 total points
ID: 11930220
>>i thought there was a way to do that without being loged in as a user.


su username
0
 
LVL 45

Assisted Solution

by:sunnycoder
sunnycoder earned 200 total points
ID: 11930223
bt707,

as Pete said, you can examine the history files present in the home directory of that user.

If you have root access, all you need to do is

su username   <<you wont be prompted for password
history

Sunnycoder
0
 
LVL 57

Expert Comment

by:Pete Long
ID: 11930229
oooh im too fast ;p
0
 
LVL 45

Expert Comment

by:sunnycoder
ID: 11930248
bt707,

ok, I tried the su method on my linux box, it does not work ...
even su - username does not work

seems like you will have to examine the history file for that user

typically
/user/home/directory/.history

or similar name like .bash_history in the home directory ...

errr, I just recd a good assist, did that work on solaris box ?

Sunnycoder
0
 
LVL 57

Expert Comment

by:Pete Long
ID: 11930250
ThanQ - That was my first - and probably last points in the solaris TA LOL

Pete
0
 

Author Comment

by:bt707
ID: 11930255
thanks to all for the fast replies back, would give all the points to both of you but they won't allow that, so I spit them up
and gave more to Petelong just becuse it hit the reply button so fast,

Thanks again
0

Featured Post

What Should I Do With This Threat Intelligence?

Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

Join & Write a Comment

A metadevice consists of one or more devices (slices). It can be expanded by adding slices. Then, it can be grown to fill a larger space while the file system is in use. However, not all UNIX file systems (UFS) can be expanded this way. The conca…
I promised to write further about my project, and here I am.  First, I needed to setup the Primary Server.  You can read how in this article: Setup FreeBSD Server with full HDD encryption (http://www.experts-exchange.com/OS/Unix/BSD/FreeBSD/A_3660-S…
Learn several ways to interact with files and get file information from the bash shell. ls lists the contents of a directory: Using the -a flag displays hidden files: Using the -l flag formats the output in a long list: The file command gives us mor…
Learn how to get help with Linux/Unix bash shell commands. Use help to read help documents for built in bash shell commands.: Use man to interface with the online reference manuals for shell commands.: Use man to search man pages for unknown command…

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

24 Experts available now in Live!

Get 1:1 Help Now