Link to home
Start Free TrialLog in
Avatar of Cheryl Lander
Cheryl LanderFlag for United States of America

asked on

how to see which script have been run over last 24 hours on linux

Im runing a plesk server on linux.

i have root password.

Ho do I see which scripts have been run in last 24 hours as someone appears to be sending mail out form our server.
Avatar of Tintin
Tintin

There's no standard way of telling what scripts have been run.  However, you can get an idea if:

1.  It scheduled via a cron or at job.
2.  The script does it's own logging.
3.  It's a CGI script.
Avatar of Cheryl Lander

ASKER

not sure.

we think someone has compromised our system, so not quite sure where to start.
I would start from the original problem - you have a mail problem.

I would check the MTA logs (sendmail) to see whether your server really put out the mail. You also can see where the mail originated from in the logs.

Also check that you do not have an open relay:
http://spamlinks.net/prevent-secure-relay-test.htm
I would check the MTA logs (sendmail) to see whether your server really put out the mail. You also can see where the mail originated from in the logs.

We have done this and nothing.

Mail came from about 3 or for email addresses.
I do not mean the from address in the mail - in the logs it is written what ip the mail originated from.

How do you know that mails were sent from your server if there is nothing in the logs?
In te mail queue in plesk.

they all appear. and my hosting provider has informed me that I have to do something about it.
First of all - back to my (important) question. Is your server an open relay? You can check that by posting your server name to some web servers (http://spamlinks.net/prevent-secure-relay-test.htm) and you will see the answer.

So the mails are logged - what MTA are you using? Sendmail, Qmail, ...?
Sorry for the delay im back onlinenow.

using qmail.

We are using relay.
ASKER CERTIFIED SOLUTION
Avatar of Blaz
Blaz
Flag of Slovenia image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Relaying is open with authorization required.