If they used sudo, then you'd be able to see it in /var/log/secure. Otherwise, if they logged in as root, you can see all root logins via: last -da | grep root The latter won't tell you what they did, only: history | less will show you recent commands, but on most systems that's limited to the last session.
If you want to log all root-level activity in the future, I'd recommend installing auditd and getting that setup--it'll watch file changes, and log who changed what and when they did so. On Sun, Jan 4, 2015 at 9:39 PM, James Mcphee <jmc...@gmail.com> wrote: > rpm -qid will give you the install date at least. > > On Sun, Jan 4, 2015 at 8:09 PM, George Toft <geo...@georgetoft.com> wrote: > >> ls -lc might give you better insight on package install time. Also rpm >> -qa | grep git, then rpm -qi <package name> >> >> Regards, >> >> George Toft >> >> On 12/31/2014 6:13 AM, Keith Smith wrote: >> >>> >>> Hi, >>> >>> I am trying to determine who installed GIT and when GIT was installed >>> and what repository it came from. >>> >>> The date stamp on /usr/share/git-core says Oct 31 16:55. The server did >>> not exist until early November. >>> >>> Thanks!! >>> >>> Keith >>> >>> >>> >> --------------------------------------------------- >> PLUG-discuss mailing list - PLUG-discuss@lists.phxlinux.org >> To subscribe, unsubscribe, or to change your mail settings: >> http://lists.phxlinux.org/mailman/listinfo/plug-discuss >> > > > > -- > James McPhee > jmc...@gmail.com > > --------------------------------------------------- > PLUG-discuss mailing list - PLUG-discuss@lists.phxlinux.org > To subscribe, unsubscribe, or to change your mail settings: > http://lists.phxlinux.org/mailman/listinfo/plug-discuss > -- Todd Millecam
--------------------------------------------------- PLUG-discuss mailing list - PLUG-discuss@lists.phxlinux.org To subscribe, unsubscribe, or to change your mail settings: http://lists.phxlinux.org/mailman/listinfo/plug-discuss
