Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I log on to a lot of different servers at work to do some tasks and install new software. However, sometimes I find myself wanting to know what has been done to the computer recently. This usually involves me going through log files and just observing the filesystem for new folders/files (usually in /tmp).

Is there some kind of a master log file which logs all (or nearly all) "activity" on the computer. Even getting a list of most recent command line 'history' from different users would be helpful to see what they did in the last couple hours. I only need to know the big things:

  • new software installs
  • important files being changed
  • new users/groups being made

Am I asking for too much from my system? If this doesn't exist I might just develop a tool to do it. In that case, which files should I be looking at to extract the information I want?

share|improve this question
    
I bet there are a few packages in existence for this kind of thing. I suppose a 'tripwire' would even help to some extent. Or perhaps SELinux has some extra logging in it - anyway - this isn't an answer since I'm not sure. –  Doc Jul 4 '11 at 15:21
    
Check out Unix Accounting. –  Daniel Beck Jul 4 '11 at 15:25
    
UNIX accounting is very cool, thanks for the reference. –  maxmackie Jul 4 '11 at 15:33
    
Consider answering yourself with what/how you use accounting. I know very little about it besides that it exists, and how you use it in detail to achieve your goal would be interesting. –  Daniel Beck Jul 4 '11 at 17:48
    
@Daniel Beck: Accounting seems to be what I'm looking for. If you'd post that as an answer I'll accept it. –  maxmackie Jul 8 '11 at 22:09

1 Answer 1

up vote 2 down vote accepted

Unix accounting helps you in figuring out who did what, when.

On my OS X system, I can use e.g. last, lastcomm and sa to get some historical user activity information. I believe Linux systems have even more commands available.

share|improve this answer
    
I will also vote this up in one hour. Thanks for your help. –  maxmackie Jul 8 '11 at 22:30
    
Damn. I sure didn't issue any find or rm calls this morning. Scary. I better to ignore this... –  Daniel Beck Jul 8 '11 at 22:33

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.