Trace unix sessions

Posted on 2005-04-13
Medium Priority
Last Modified: 2012-08-14
On our unix boxes (both hp & sun) we login first with our personal ids and then su to oracle id ... is there a way to trace which all personal ids are logged in as oracle ? ... the issue is to find out which personal id kicked off a particular sql ...


Question by:vrrajeeb
LVL 34

Assisted Solution

PsiCop earned 105 total points
ID: 13775078
Well, if configured, the system will record use of su. /etc/syslog.conf needs to be configured to direct auth.* messages to a file somewhere. It'll record who successfully does su, and when. Doesn't make note of when they exit the superuser shell, tho. So if Bob does an su at 10:03am, and Judy does one at 10:12am, and the Oracle account is used to kick off an ID at 10:29am, who did it, Bob or Judy?

Perhaps you should be using sudo instead. Instead of giving individuals full su access, where they have complete run of the system (and could, for example, alter the logs I mentioned above), use a tool that will limit their access to specific tasks/commands, and can also keep better track of who does what when. See --> http://www.courtesan.com/sudo
LVL 15

Accepted Solution

veedar earned 120 total points
ID: 13775352
I like sudo as well but also check out the commands ...
last -a
who -a
ps  aux  (or is it  ps -ef)
....in combination they may help you track it down
by keying on which TTY the offender is using.

lsof may be worth a lock as well.

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Hello I read in a discussion about a person who configured a very simple mirror RAID with two hard drives; the system and data were on the same partition. He asked how to repair the system as it was not booting up anymore. In his case running …
Windows 10 is here and for most admins this means frustration and challenges getting that first working Windows 10 image. As in my previous sysprep articles, I've put together a simple help guide to get you through this process. The aim is to achiev…
This is used to tweak the memory usage for your computer, it is used for servers more so than workstations but just be careful editing registry settings as it may cause irreversible results. I hold no responsibility for anything you do to the regist…
Hi friends,  in this video  I'll show you how new windows 10 user can learn the using of windows 10. Thank you.
Suggested Courses

807 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question