Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I know that the date -s <STRING> command sets the time described by the string STRING.

What i want is to log the above command whenever it is used to set the time into the file /tmp/log/user.log.

In my Linux distribution the logging is done by syslog-ng. I already have some logs going into /tmp/log/user.log.

This is the content of /etc/syslog-ng/syslog-ng.conf in my system for logging into /tmp/log/user.log

destination d_notice  { file("/tmp/log/user.log");};

filter f_filter10   { level(notice) and not facility(mail,authpriv,cron); };

log { source(s_sys); filter(f_filter10); destination(d_notice); };

What should i do so that date -s command is also logged into /tmp/log/user.log

share|improve this question

Date changes are not logged by default, at least not on Debian.

The simplest option would be to replace /bin/date with a wrapper that prints a log message using logger then calls the real /bin/date executable, e.g.

mv /bin/date /bin/date.real
cat << 'EOF' >/bin/date
logger -p user.notice "date run by $UID: $*"
chmod +x /bin/date

Other than that, I know that grsecurity allows you to log any changes to the system time. It would require compiling a custom kernel.

share|improve this answer
I agree with you. But if i use this, date -s command will show the date , date -<somejunk> will also show the date – LinuxPenseur Dec 21 '10 at 12:48

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.