Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 1 down vote favorite

On a CentOS 5.x server, I'm troubleshooting an issue and need to determine when a service foo stop command was executed. The logs for the respective service don't indicate this. I only see the command itself in the output for history. This was run from a root shell, not through sudo.

Is there another way to determine when commands were run?

share|improve this question
1  
Dupe of superuser.com/questions/279423/… – smithian Oct 23 '12 at 17:03
@MikeB Having an idea about the application would allow some alternative methods of determining the end time... lock files, timestamps, etc. This question is unanswerable in this state. – ewwhite Oct 24 '12 at 15:49

2 Answers

up vote 5 down vote accepted

CentOS by default does not keep track of when commands are run. As mentioned in a similar Question, you can configure your shell to record it's history of commands with timestamps (but this is not enabled by default). Also, as ewwhite mentions, there may be clues such as lock files, log access/modified timestamps, etc; but none of these are guaranteed easy to read or definitive indicators.

share|improve this answer
Thanks Chris. That's exactly what I wanted to know. Wasn't sure if I was missing some obvious audit logs for all root command actions. – Mike B Oct 24 '12 at 16:02
up vote 3 down vote

Try lastcomm, if it's installed and running (check the psacct service) it will give you a report of when processes were executed, and various other details.

It's part of the acct package.

~$ lastcomm
[...]
nagios             F    nagios   __         0.10 secs Wed Oct 24 17:16
nagios             F    nagios   __         0.07 secs Wed Oct 24 17:16
nagios             F    nagios   __         0.09 secs Wed Oct 24 17:16
check_http              nagios   __         0.11 secs Wed Oct 24 17:16
perl                    nagios   __         3.70 secs Wed Oct 24 17:16
sh                      nagios   __         0.03 secs Wed Oct 24 17:16
psacct                  root     pts/0      0.08 secs Wed Oct 24 17:16
touch                   root     pts/0      0.02 secs Wed Oct 24 17:16
accton            S     root     pts/0      0.01 secs Wed Oct 24 17:16
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.