0

I was curious to know if there are 3 or 4 people who has root access to a node. one of the person has initiated a job for running, But some one has killed the job that was running. what would be the best way to identify the person who killed the job/process because every body has root access.

Improve this question
2
  • 1
    Check with last command from which IP is logged the user in the time or killed process
    – Romeo Ninov
    May 15, 2015 at 15:56
  • 1
    Please don't create multiple posts on the SE network. Questions can be migrated if they need to be. You can flag your own question, check "needs moderator attension" and give the reason why you would like to migrate your question. Here is your question on SO: stackoverflow.com/a/30245298/816536
    – Cfinley
    May 22, 2015 at 20:10

1 Answer 1

Reset to default
0

Impossible without proper auditing enabled. Without auditing you can only guess based on timestamps on when exactly the job was killed (if you have such information) and which users were logged in. I guess they are logging in as normal users and using something like su or sudo to become root.

About auditing - basic would be to have a login script for root which would set a different history file based on who is switching to root. For more sophisticated auditing (kernel itself logging which user does what), google for "linux auditing".

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .