Hi,
my original question was:
>We've got a Sparc20 with Solaris 2.5 and all our users run /bin/ksh.
>I would like to know whether there is a way of getting a user's command
>history time stamped in the .sh_history file (or anywhere else).
>Also, in the /var/adm/sulog file info of who did the su command is kept,
>how can I tell when a user logged out? I know that the "last" command gives
>the login and logoff time of users, but only if they were logged in
>directly and not with "su".
Thanks to:
JOSEPH AAJ Chackompally <AAJ@necsin.nec.com.sg>
ddelija@srce.hr (Damir Delija)
FreakaZoid <shadow6@bellsouth.net>
Joseph S D Yao <jsdy@gwyn.tux.org>
It was suggested that I turn accounting on and use "acctcom" to have a look
at the /var/adm/pacct file, which should give me timestamped details of a
users command history. I have done this and it works fine, except it only
gives the general command which was run, and no details, eg. for copying a
file "cp file1 file2" it will only give me "cp".
I could write a small script that will correlate the ports of a user that
su'ed and when they issued the exit/logout process to see when that person
logged off. Haven't done this yet.
Thanks again to everyone who answered!
Anja
=======================================
Anja Mitchell
Corporate Information Technology
Dept. of Environment & Land Mngmt.
Hobart, Tasmania
Australia
Ph: +61-03-62333300
Fax: +61-03-62336775
email: anja@delm.tas.gov.au
This archive was generated by hypermail 2.1.2 : Fri Sep 28 2001 - 23:12:29 CDT