Solved

Last commands

Posted on 2004-08-30
13
333 Views
Last Modified: 2013-12-27
I can't remember the right command, how do you look to see what the last commands that was run by certain users.
am on a solais 9 box.

Thanks,
0
Comment
Question by:bt707
  • 7
  • 4
  • 2
13 Comments
 
LVL 57

Expert Comment

by:Pete Long
ID: 11930148
history | more
Show the last (1000 or so) commands executed from the command line on the current account. The | more causes the display to stop after each screen fill.

0
 
LVL 57

Expert Comment

by:Pete Long
ID: 11930165
NAME
     lastcomm - display the last commands  executed,  in  reverse
     order



SYNOPSIS
     lastcomm [ command-name ] ... [ user-name ] ...
          [ terminal-name ] ...



DESCRIPTION
     The lastcomm command gives information  on  previously  exe-
     cuted  commands.  lastcomm with no arguments displays infor-
     mation about all the commands recorded  during  the  current
     accounting  file's  lifetime.   If  called  with  arguments,
     lastcomm only displays accounting entries  with  a  matching
     command-name, user-name, or terminal-name.

     If terminal-name is `- -' there was no controlling  TTY  for
     the  process.  The process was probably executed during boot
     time.  If terminal-name is `??', the controlling  TTY  could
     not be decoded into a printable name.



EXAMPLES
     The command:
          example% lastcomm a.out root term/01

     produces a listing of all the executions of  commands  named
     a.out, by user root while using the terminal term/01.

     The command:
          example% lastcomm root

     produces a listing of all  the  commands  executed  by  user
     root.

     For each process  entry,  lastcomm  displays  the  following
     items of information:

          o  The command name under which the process was called.

          o  One or more  flags  indicating  special  information
             about  the  process.   The  flags have the following
             meanings:

               F  The process performed a fork but not an exec.

               S  The process ran as a set-user-id program.

          o  The name of the user who ran the process.

          o  The terminal which the user was logged in on at  the
             time (if applicable).

          o  The amount of CPU  time  used  by  the  process  (in
             seconds).

          o  The date and time the process exited.

http://www.biostat.wisc.edu/cgi-bcg/man.cgi?section=all&topic=lastcomm
0
 
LVL 45

Expert Comment

by:sunnycoder
ID: 11930170
Hi bt707,

login as that user and use history command

history

Sunnycoder
0
 
LVL 45

Expert Comment

by:sunnycoder
ID: 11930183
PeteLong,

that was faaaaast ... sorry

Sunnycoder
0
 
LVL 57

Expert Comment

by:Pete Long
ID: 11930197
or look at that user's command history (in ~user/.history).
0
 
LVL 57

Expert Comment

by:Pete Long
ID: 11930204
:) no need to appologise - its not often I get a shot at a solaris Q :)
0
Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

 

Author Comment

by:bt707
ID: 11930210
I do use the last | more command, but that only tells who loged in and what time, does not show what commands was used.

Sunnycoder, i have root rights but do you have to login as that user and use the history command, i thought there was a way to do that without being loged in as a user.

Thanks
0
 
LVL 57

Accepted Solution

by:
Pete Long earned 300 total points
ID: 11930220
>>i thought there was a way to do that without being loged in as a user.


su username
0
 
LVL 45

Assisted Solution

by:sunnycoder
sunnycoder earned 200 total points
ID: 11930223
bt707,

as Pete said, you can examine the history files present in the home directory of that user.

If you have root access, all you need to do is

su username   <<you wont be prompted for password
history

Sunnycoder
0
 
LVL 57

Expert Comment

by:Pete Long
ID: 11930229
oooh im too fast ;p
0
 
LVL 45

Expert Comment

by:sunnycoder
ID: 11930248
bt707,

ok, I tried the su method on my linux box, it does not work ...
even su - username does not work

seems like you will have to examine the history file for that user

typically
/user/home/directory/.history

or similar name like .bash_history in the home directory ...

errr, I just recd a good assist, did that work on solaris box ?

Sunnycoder
0
 
LVL 57

Expert Comment

by:Pete Long
ID: 11930250
ThanQ - That was my first - and probably last points in the solaris TA LOL

Pete
0
 

Author Comment

by:bt707
ID: 11930255
thanks to all for the fast replies back, would give all the points to both of you but they won't allow that, so I spit them up
and gave more to Petelong just becuse it hit the reply button so fast,

Thanks again
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
what is the meaning of filesystem loop detected? 7 929
Shell script errors 10 113
Unix/bash: scripted arithmetic 13 92
Shell Script on AIX 7 61
A metadevice consists of one or more devices (slices). It can be expanded by adding slices. Then, it can be grown to fill a larger space while the file system is in use. However, not all UNIX file systems (UFS) can be expanded this way. The conca…
FreeBSD on EC2 FreeBSD (https://www.freebsd.org) is a robust Unix-like operating system that has been around for many years. FreeBSD is available on Amazon EC2 through Amazon Machine Images (AMIs) provided by FreeBSD developer and security office…
Learn how to navigate the file tree with the shell. Use pwd to print the current working directory: Use ls to list a directory's contents: Use cd to change to a new directory: Use wildcards instead of typing out long directory names: Use ../ to move…
This video shows how to set up a shell script to accept a positional parameter when called, pass that to a SQL script, accept the output from the statement back and then manipulate it in the Shell.

943 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now