Re: Finding date a command was executed
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On May 15, 2002, 13:33 (-0400) Keith Winston wrote: > On Wed, May 15, 2002 at 07:20:42PM +0200, Wolfgang Pfeiffer wrote: > > after a first glance on 'man lastcomm' and some simple tests with the > > tool it *seems* that - concerning its abillity to deliver infos on > > previous commands - it works only for commands exctd. *after* the time > > of the psacct install ... so although Im prepared now for the future > > :) I still have the problem for the "old" (pre-install-) commands in > > bash_history ... > > > > Again: thanks, Wanderlei Antonio Cavassin, but I'm still having a > > problem :) > > Without psacct, the only way to find out when a command ran is if it > left some trail behind in a log file. Have you run grep on all your log > files? ... yo, just did that: nothing, as I expected: because most of the commands that are logged there, are -if I understood correctly- commands very relevant to system security, such as when a file system has been mounted too often without having run a fsck on it, or when a dial-in command was made etc but "normal" commands, like deleting a file or so, are IINM not recorded there .. Thanks for your help, Keith ... I think I'll give up now. A hint for Red Hat, if someone from the company is reading this: I have here Red Hat 6.2 on the machine, and psacct - as it seems - was not installed here per default ... I don't know how this situation was handled in subsequent releases, but *if* psacct still today (i.e. on Red Hat 7.3) is not installed per default it might be perhaps a good idea to change this situation in future releases. Thanks for at least considering it, Red Hat Inc. ... :) And thanks a lot, again, to those who helped. Regards Wolfgang > > Best Regards, > Keith > - -- GnuPG Key: http://home.t-online.de/home/520050060325-0001/key.asc Key fingerprint = 6DD7 F9BF 689B 60D4 B20E 9087 7409 6EAF DD0A 8B01 http://www.geocities.com/wolfgangpfeiffer/ -- END TRANSMISSION -- -BEGIN PGP SIGNATURE- Version: GnuPG v1.0.7 (GNU/Linux) iD8DBQE84qjcdAlur90KiwERAg4tAJoDRVBdKI5oL0SctEkYDDPrkDn62QCgm5b+ A3KhOZHfS5MllYJ6cBM6GkU= =a/l5 -END PGP SIGNATURE- ___ Redhat-list mailing list [EMAIL PROTECTED] https://listman.redhat.com/mailman/listinfo/redhat-list
Re: Finding date a command was executed
On Wed, May 15, 2002 at 07:20:42PM +0200, Wolfgang Pfeiffer wrote: > after a first glance on 'man lastcomm' and some simple tests with the > tool it *seems* that - concerning its abillity to deliver infos on > previous commands - it works only for commands exctd. *after* the time > of the psacct install ... so although Im prepared now for the future > :) I still have the problem for the "old" (pre-install-) commands in > bash_history ... > > Again: thanks, Wanderlei Antonio Cavassin, but I'm still having a > problem :) Without psacct, the only way to find out when a command ran is if it left some trail behind in a log file. Have you run grep on all your log files? Best Regards, Keith -- LPIC-2, MCSE, N+ Will we all fight for the right to be free? Got spam? Get spastic http://spastic.sourceforge.net ___ Redhat-list mailing list [EMAIL PROTECTED] https://listman.redhat.com/mailman/listinfo/redhat-list
Re: Finding date a command was executed
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi, Thanks for the great tip -- just installed a Redhat package for psacct, and 'tho not yet knowing too much on the details of the tool: after a first glance on 'man lastcomm' and some simple tests with the tool it *seems* that - concerning its abillity to deliver infos on previous commands - it works only for commands exctd. *after* the time of the psacct install ... so although Im prepared now for the future :) I still have the problem for the "old" (pre-install-) commands in bash_history ... Again: thanks, Wanderlei Antonio Cavassin, but I'm still having a problem :) Regards Wolfgang On May 15, 2002, 13:06 (-0300) Wanderlei Antonio Cavassin wrote: > > Install psacct (enable proccess accounting) and use > lastcomm command. > > [ ... ] > > Regards, > Wanderlei Antonio Cavassin > Conectiva Linux > > > Em Wed, May 15, 2002 at 05:51:12PM +0200, Wolfgang Pfeiffer escreveu: > > Hi, > > > > Is it possible to find out the exact date a specific command was > > executed on the machine? > > [ ... ] - -- GnuPG Key: http://home.t-online.de/home/520050060325-0001/key.asc Key fingerprint = 6DD7 F9BF 689B 60D4 B20E 9087 7409 6EAF DD0A 8B01 http://www.geocities.com/wolfgangpfeiffer/ -- END TRANSMISSION -- -BEGIN PGP SIGNATURE- Version: GnuPG v1.0.7 (GNU/Linux) iD8DBQE84pnXdAlur90KiwERApBdAJ4tPG8F67JH9vqXOaLzM/ptdjCPcQCdFf6Y P10T+EgeLaTmjJb2/ns4GmU= =eADK -END PGP SIGNATURE- ___ Redhat-list mailing list [EMAIL PROTECTED] https://listman.redhat.com/mailman/listinfo/redhat-list
Re: Finding date a command was executed
Install psacct (enable proccess accounting) and use lastcomm command. LASTCOMM(1) LASTCOMM(1) NAME lastcomm - print out information about previously exe cuted commands. # rpm -qf /usr/bin/lastcomm psacct-6.3.5-1cl (this package is from Conectiva Linux - search one available for your distro) Regards, Wanderlei Antonio Cavassin Conectiva Linux Em Wed, May 15, 2002 at 05:51:12PM +0200, Wolfgang Pfeiffer escreveu: > Hi, > > Is it possible to find out the exact date a specific command was > executed on the machine? > > Scanning man bash or groups.googling didn't help. > > Thanks a lot in anticipation :) > > Regards > Wolfgang ___ Redhat-list mailing list [EMAIL PROTECTED] https://listman.redhat.com/mailman/listinfo/redhat-list
