Solved

.sh_history question

Posted on 2009-07-08
3
769 Views
Last Modified: 2012-05-07
On our UNIX system , we have a common account. there are around 6 users who can log into that account. the $HOME/.sh_history file has shown some suspicious commands . ( somebody deleted important files using rm command)..   Through this .sh_history file can i get to know who was the user who ran the rm commands.

One thing to note is everybody first loginto thier indiviuval account and then by using su command they log into common account.

the .sh_history file shows only commands. Can me or adming with extra rights get to know who was the actual user who ran those commands.
0
Comment
Question by:n78298
  • 2
3 Comments
 
LVL 68

Expert Comment

by:woolmilkporc
Comment Utility
Hi,
with 'su' there should be a logfile called 'sulog' somewhere, depending on your OS.
In some systems, logging is controlled by the environment variable 'SULOG_FILE'
Additionally, there could be syslog entries.
Please check!
wmp
 
 
0
 

Author Comment

by:n78298
Comment Utility
without su coming into picture , can;t we identify who was the user who issues those commands.
0
 
LVL 68

Accepted Solution

by:
woolmilkporc earned 500 total points
Comment Utility
No, unfortunately not, as the history files belong to the target user ('common account'). There is no information contained where the user came from.
You could check who logged in from where at which time using the 'last' command, given you keep the 'wtmp' file long enough.
See 'man last' for details.
wmp
 
 
0

Featured Post

Maximize Your Threat Intelligence Reporting

Reporting is one of the most important and least talked about aspects of a world-class threat intelligence program. Here’s how to do it right.

Join & Write a Comment

I have been running these systems for a few years now and I am just very happy with them.   I just wanted to share the manual that I have created for upgrades and other things.  Oooh yes! FreeBSD makes me happy (as a server), no maintenance and I al…
Java performance on Solaris - Managing CPUs There are various resource controls in operating system which directly/indirectly influence the performance of application. one of the most important resource controls is "CPU".   In a multithreaded…
Learn how to navigate the file tree with the shell. Use pwd to print the current working directory: Use ls to list a directory's contents: Use cd to change to a new directory: Use wildcards instead of typing out long directory names: Use ../ to move…
In a previous video, we went over how to export a DynamoDB table into Amazon S3.  In this video, we show how to load the export from S3 into a DynamoDB table.

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

6 Experts available now in Live!

Get 1:1 Help Now