I log on to a lot of different servers at work to do some tasks and install new software. However, sometimes I find myself wanting to know what has been done to the computer recently. This usually involves me going through log files and just observing the filesystem for new folders/files (usually in /tmp).

Is there some kind of a master log file which logs all (or nearly all) "activity" on the computer. Even getting a list of most recent command line 'history' from different users would be helpful to see what they did in the last couple hours. I only need to know the big things:

  • new software installs
  • important files being changed
  • new users/groups being made

Am I asking for too much from my system? If this doesn't exist I might just develop a tool to do it. In that case, which files should I be looking at to extract the information I want?

  • I bet there are a few packages in existence for this kind of thing. I suppose a 'tripwire' would even help to some extent. Or perhaps SELinux has some extra logging in it - anyway - this isn't an answer since I'm not sure. – James T Snell Jul 4 '11 at 15:21
  • Check out Unix Accounting. – Daniel Beck Jul 4 '11 at 15:25
  • UNIX accounting is very cool, thanks for the reference. – n0pe Jul 4 '11 at 15:33
  • Consider answering yourself with what/how you use accounting. I know very little about it besides that it exists, and how you use it in detail to achieve your goal would be interesting. – Daniel Beck Jul 4 '11 at 17:48
  • @Daniel Beck: Accounting seems to be what I'm looking for. If you'd post that as an answer I'll accept it. – n0pe Jul 8 '11 at 22:09

Unix accounting helps you in figuring out who did what, when.

On my OS X system, I can use e.g. last, lastcomm and sa to get some historical user activity information. I believe Linux systems have even more commands available.

  • I will also vote this up in one hour. Thanks for your help. – n0pe Jul 8 '11 at 22:30
  • Damn. I sure didn't issue any find or rm calls this morning. Scary. I better to ignore this... – Daniel Beck Jul 8 '11 at 22:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.