up vote 4 down vote favorite
2
share [g+] share [fb]

I log on to a lot of different servers at work to do some tasks and install new software. However, sometimes I find myself wanting to know what has been done to the computer recently. This usually involves me going through log files and just observing the filesystem for new folders/files (usually in /tmp).

Is there some kind of a master log file which logs all (or nearly all) "activity" on the computer. Even getting a list of most recent command line 'history' from different users would be helpful to see what they did in the last couple hours. I only need to know the big things:

  • new software installs
  • important files being changed
  • new users/groups being made

Am I asking for too much from my system? If this doesn't exist I might just develop a tool to do it. In that case, which files should I be looking at to extract the information I want?

link|improve this question
96% accept rate
I bet there are a few packages in existence for this kind of thing. I suppose a 'tripwire' would even help to some extent. Or perhaps SELinux has some extra logging in it - anyway - this isn't an answer since I'm not sure. – Doc Jul 4 '11 at 15:21
Check out Unix Accounting. – Daniel Beck Jul 4 '11 at 15:25
UNIX accounting is very cool, thanks for the reference. – MaxMackie Jul 4 '11 at 15:33
Consider answering yourself with what/how you use accounting. I know very little about it besides that it exists, and how you use it in detail to achieve your goal would be interesting. – Daniel Beck Jul 4 '11 at 17:48
@Daniel Beck: Accounting seems to be what I'm looking for. If you'd post that as an answer I'll accept it. – MaxMackie Jul 8 '11 at 22:09
feedback

1 Answer

up vote 2 down vote accepted

Unix accounting helps you in figuring out who did what, when.

On my OS X system, I can use e.g. last, lastcomm and sa to get some historical user activity information. I believe Linux systems have even more commands available.

link|improve this answer
I will also vote this up in one hour. Thanks for your help. – MaxMackie Jul 8 '11 at 22:30
Damn. I sure didn't issue any find or rm calls this morning. Scary. I better to ignore this... – Daniel Beck Jul 8 '11 at 22:33
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.