Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I log on to a lot of different servers at work to do some tasks and install new software. However, sometimes I find myself wanting to know what has been done to the computer recently. This usually involves me going through log files and just observing the filesystem for new folders/files (usually in /tmp).

Is there some kind of a master log file which logs all (or nearly all) "activity" on the computer. Even getting a list of most recent command line 'history' from different users would be helpful to see what they did in the last couple hours. I only need to know the big things:

  • new software installs
  • important files being changed
  • new users/groups being made

Am I asking for too much from my system? If this doesn't exist I might just develop a tool to do it. In that case, which files should I be looking at to extract the information I want?

share|improve this question
I bet there are a few packages in existence for this kind of thing. I suppose a 'tripwire' would even help to some extent. Or perhaps SELinux has some extra logging in it - anyway - this isn't an answer since I'm not sure. – Doc Jul 4 '11 at 15:21
Check out Unix Accounting. – Daniel Beck Jul 4 '11 at 15:25
UNIX accounting is very cool, thanks for the reference. – n0pe Jul 4 '11 at 15:33
Consider answering yourself with what/how you use accounting. I know very little about it besides that it exists, and how you use it in detail to achieve your goal would be interesting. – Daniel Beck Jul 4 '11 at 17:48
@Daniel Beck: Accounting seems to be what I'm looking for. If you'd post that as an answer I'll accept it. – n0pe Jul 8 '11 at 22:09
up vote 2 down vote accepted

Unix accounting helps you in figuring out who did what, when.

On my OS X system, I can use e.g. last, lastcomm and sa to get some historical user activity information. I believe Linux systems have even more commands available.

share|improve this answer
I will also vote this up in one hour. Thanks for your help. – n0pe Jul 8 '11 at 22:30
Damn. I sure didn't issue any find or rm calls this morning. Scary. I better to ignore this... – Daniel Beck Jul 8 '11 at 22:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .