my original question was:
>We've got a Sparc20 with Solaris 2.5 and all our users run /bin/ksh.
>I would like to know whether there is a way of getting a user's command
>history time stamped in the .sh_history file (or anywhere else).
>Also, in the /var/adm/sulog file info of who did the su command is kept,
>how can I tell when a user logged out? I know that the "last" command gives
>the login and logoff time of users, but only if they were logged in
>directly and not with "su".
JOSEPH AAJ Chackompally <AAJ@necsin.nec.com.sg>
email@example.com (Damir Delija)
Joseph S D Yao <firstname.lastname@example.org>
It was suggested that I turn accounting on and use "acctcom" to have a look
at the /var/adm/pacct file, which should give me timestamped details of a
users command history. I have done this and it works fine, except it only
gives the general command which was run, and no details, eg. for copying a
file "cp file1 file2" it will only give me "cp".
I could write a small script that will correlate the ports of a user that
su'ed and when they issued the exit/logout process to see when that person
logged off. Haven't done this yet.
Thanks again to everyone who answered!
Corporate Information Technology
Dept. of Environment & Land Mngmt.
This archive was generated by hypermail 2.1.2 : Fri Sep 28 2001 - 23:12:29 CDT