I expect that this is wishful thinking but my work (Linux) server contains a lot of scripts not particularly well organised. I am new to Linux, would there be a historical list of scripts that have recently ran?

  • 1
    Run by a user or run by the system? And if by a user, is the account shared by the server administrators? – Alessandro Dotti Contra Mar 12 '17 at 18:17
  • You can follow the syslog and see what happens on a regular basis. And chances are the scripts run as part of a cronjob and there are scripts out there that can parse cronjobs across the system so you can see what might run when and where. But that still doesn’t factor in scripts that might—for example—be run by a non-user or task you are not aware of. – Giacomo1968 Mar 12 '17 at 18:18

The history command will list commands run by a given user which should include any scripts that have been run.

| improve this answer | |
  • in bash the history command is a shell built-in command (see man bash or help history while running bash). the environment variable HISTFILE, if set, specifies the history list location; if not set a builtin default is used ($HOME/.bash_history on my system). history itself won't show you the history of other users, but you could inspect their /home/otheruser/.bash_history file if it's readable. – quixotic Mar 12 '17 at 19:55

Not sure why hardillb got voted down, he's correct. Check the .bash_history, or history command. If you have root, check other users history. You can use last to see which user has logged in, when, and check that user's history. It won't help with system cron commands.

To his response I will add:

  1. Use find ./ type -f -atime -7 -iname "*.sh" (or *.pl, or any other script extensions you can think of.). This will tell you files that were accessed in the last 7 days according to the FS access time value. It won't work if the filesystem has been mounted with noatime.
  2. Check /var/log/cronlog or syslog if it isn't logging cron events.
  3. If you add -executable to that find command above, instead of looking for ".sh" or ".pl", then it should find files with an executable bit that have been accessed in 7 days. Not all scripts are executable, so the -iname option is useful too.

The list provided by "find" won't be access time sorted, but you can pseudo-accomplish it by testing with -1, then -2, then -3 ... -7 days, at least they'll be grouped by day.


| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.