Re: determining when root was logged in

From: Sue Pellerito (Sue.Pellerito_at_JACKINTHEBOX.COM)
Date: 10/25/03

  • Next message: Fernandez Garay Jorge: "Dumping file accesses in octal mode" 
    Date:         Fri, 24 Oct 2003 15:37:55 -0700
To: aix-l@Princeton.EDU

    If a user logged on with their userid and then used a su - to switch to
    root, the 'last' command will not show root as logged in.

                          Vipin Khushu
                          <vkhushu@GUERNSEY To: aix-l@Princeton.EDU
                          OP.COM> cc:
                          Sent by: IBM AIX Subject: Re: determining when root was logged in
                          Discussion List
                          <aix-l@Princeton.
                          EDU>

                          10/24/2003 12:58
                          PM
                          Please respond to
                          IBM AIX
                          Discussion List

    Thanks Mark / Bill.

    However, this gets curiouser and curiouser.

    The last root command shows that the last time root logged into the system
    was back on sep 09.

    However, we are sure that this file was modified yesterday.

    Is there a way to determine who modified this file?

    Vipin

    -----Original Message-----
    From: Bill Verzal [mailto:BVerzal@KOMATSUNA.COM]
    Sent: Friday, October 24, 2003 1:49 PM
    To: aix-l@Princeton.EDU
    Subject: Re: determining when root was logged in

    last|more
    /etc/passwd and /etc/group
    --------------------------------------------------------

    "If everything is coming your way, then you are in the wrong lane"

    Bill Verzal
    AIX Administrator, Komatsu America
    (847) 970-3726 - direct
    (847) 970-4184 - fax

    |---------+---------------------------->
    | | Vipin Khushu |
    | | <vkhushu@GUERNSEY|
    | | OP.COM> |
    | | Sent by: IBM AIX |
    | | Discussion List |
    | | <aix-l@Princeton.|
    |
    | | |
    | | |
    | | 10/24/2003 12:03 |
    | | PM |
    | | Please respond to|
    | | IBM AIX |
    | | Discussion List |
    | | |
    |---------+---------------------------->

    >---------------------------------------------------------------------------

    ----------------------------------------------------|
      |
    |
      | To: aix-l@Princeton.EDU
    |
      | cc:
    |
      | Subject: determining when root was logged in
    |

    >---------------------------------------------------------------------------

    ----------------------------------------------------|

    I need to pinpoint who was logged in as root yesterday when this file was
    modified. So I would like to know what time the person / process got logged
    in as root and from what terminal / IP address.

    Also does anyone know where the list of users that are set up on the system
    are stored?

    I need to show the users that are set up as part of the system group.

    -rw-rw-rw- 1 root sys 26624 Oct 23 13:46 -dayend.cdx

    -rw-rw-rw- 1 root sys 42844 Oct 23 13:46 -dayend.dbf

    -rw-rw-rw- 1 root sys 10 Aug 02 10:03 -dayend.key

    TIA

    Vipin Khushu

  • Next message: Fernandez Garay Jorge: "Dumping file accesses in octal mode"

    Relevant Pages