Solved

Last commands

Posted on 2004-08-30
13
340 Views
Last Modified: 2013-12-27
I can't remember the right command, how do you look to see what the last commands that was run by certain users.
am on a solais 9 box.

Thanks,
0
Comment
Question by:bt707
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 7
  • 4
  • 2
13 Comments
 
LVL 57

Expert Comment

by:Pete Long
ID: 11930148
history | more
Show the last (1000 or so) commands executed from the command line on the current account. The | more causes the display to stop after each screen fill.

0
 
LVL 57

Expert Comment

by:Pete Long
ID: 11930165
NAME
     lastcomm - display the last commands  executed,  in  reverse
     order



SYNOPSIS
     lastcomm [ command-name ] ... [ user-name ] ...
          [ terminal-name ] ...



DESCRIPTION
     The lastcomm command gives information  on  previously  exe-
     cuted  commands.  lastcomm with no arguments displays infor-
     mation about all the commands recorded  during  the  current
     accounting  file's  lifetime.   If  called  with  arguments,
     lastcomm only displays accounting entries  with  a  matching
     command-name, user-name, or terminal-name.

     If terminal-name is `- -' there was no controlling  TTY  for
     the  process.  The process was probably executed during boot
     time.  If terminal-name is `??', the controlling  TTY  could
     not be decoded into a printable name.



EXAMPLES
     The command:
          example% lastcomm a.out root term/01

     produces a listing of all the executions of  commands  named
     a.out, by user root while using the terminal term/01.

     The command:
          example% lastcomm root

     produces a listing of all  the  commands  executed  by  user
     root.

     For each process  entry,  lastcomm  displays  the  following
     items of information:

          o  The command name under which the process was called.

          o  One or more  flags  indicating  special  information
             about  the  process.   The  flags have the following
             meanings:

               F  The process performed a fork but not an exec.

               S  The process ran as a set-user-id program.

          o  The name of the user who ran the process.

          o  The terminal which the user was logged in on at  the
             time (if applicable).

          o  The amount of CPU  time  used  by  the  process  (in
             seconds).

          o  The date and time the process exited.

http://www.biostat.wisc.edu/cgi-bcg/man.cgi?section=all&topic=lastcomm
0
 
LVL 45

Expert Comment

by:sunnycoder
ID: 11930170
Hi bt707,

login as that user and use history command

history

Sunnycoder
0
Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 45

Expert Comment

by:sunnycoder
ID: 11930183
PeteLong,

that was faaaaast ... sorry

Sunnycoder
0
 
LVL 57

Expert Comment

by:Pete Long
ID: 11930197
or look at that user's command history (in ~user/.history).
0
 
LVL 57

Expert Comment

by:Pete Long
ID: 11930204
:) no need to appologise - its not often I get a shot at a solaris Q :)
0
 

Author Comment

by:bt707
ID: 11930210
I do use the last | more command, but that only tells who loged in and what time, does not show what commands was used.

Sunnycoder, i have root rights but do you have to login as that user and use the history command, i thought there was a way to do that without being loged in as a user.

Thanks
0
 
LVL 57

Accepted Solution

by:
Pete Long earned 300 total points
ID: 11930220
>>i thought there was a way to do that without being loged in as a user.


su username
0
 
LVL 45

Assisted Solution

by:sunnycoder
sunnycoder earned 200 total points
ID: 11930223
bt707,

as Pete said, you can examine the history files present in the home directory of that user.

If you have root access, all you need to do is

su username   <<you wont be prompted for password
history

Sunnycoder
0
 
LVL 57

Expert Comment

by:Pete Long
ID: 11930229
oooh im too fast ;p
0
 
LVL 45

Expert Comment

by:sunnycoder
ID: 11930248
bt707,

ok, I tried the su method on my linux box, it does not work ...
even su - username does not work

seems like you will have to examine the history file for that user

typically
/user/home/directory/.history

or similar name like .bash_history in the home directory ...

errr, I just recd a good assist, did that work on solaris box ?

Sunnycoder
0
 
LVL 57

Expert Comment

by:Pete Long
ID: 11930250
ThanQ - That was my first - and probably last points in the solaris TA LOL

Pete
0
 

Author Comment

by:bt707
ID: 11930255
thanks to all for the fast replies back, would give all the points to both of you but they won't allow that, so I spit them up
and gave more to Petelong just becuse it hit the reply button so fast,

Thanks again
0

Featured Post

[Webinar] Code, Load, and Grow

Managing multiple websites, servers, applications, and security on a daily basis? Join us for a webinar on May 25th to learn how to simplify administration and management of virtual hosts for IT admins, create a secure environment, and deploy code more effectively and frequently.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
SSH commands for Nas4free 21 554
unable to put logic for reading multiple repo in a single file 4 108
Unix Script: Loop over all days of a month 17 133
centos commands 6 118
Let's say you need to move the data of a file system from one partition to another. This generally involves dismounting the file system, backing it up to tapes, and restoring it to a new partition. You may also copy the file system from one place to…
This tech tip describes how to install the Solaris Operating System from a tape backup that was created using the Solaris flash archive utility. I have used this procedure on the Solaris 8 and 9 OS, and it shoudl also work well on the Solaris 10 rel…
Learn several ways to interact with files and get file information from the bash shell. ls lists the contents of a directory: Using the -a flag displays hidden files: Using the -l flag formats the output in a long list: The file command gives us mor…
Learn how to find files with the shell using the find and locate commands. Use locate to find a needle in a haystack.: With locate, check if the file still exists.: Use find to get the actual location of the file.:
Suggested Courses

710 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question