Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there any way to determine what shell scripts ran within a certain time frame? I.e. I need to know all the shell scripts that ran yesterday between 2:00 an 5:00.

share|improve this question

closed as unclear what you're asking by DanBig, mdpc, TheCleaner, Tim Brigham, Bryan Jul 23 '13 at 22:00

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question.If this question can be reworded to fit the rules in the help center, please edit the question.

You need to give way more information about your system and what kind of logging is in place before this can be answered. – superuser0 Jul 23 '13 at 17:29

There is no such recording in general, unless the scripts systematically logs to system logs when they run, or they were run as cron jobs. You can look at shell history for all the users, but these have no time recorded.

share|improve this answer
history does have time recorded if you want it to. Just set HISTTIMEFORMAT="%FT%T%z ". – dawud Jul 23 '13 at 17:35
ah yes, thanks. i meant by default it does not. – johnshen64 Jul 23 '13 at 17:36
also, if you set up sudo, then any command ran with sudo will be logged. since these are likely of most concern, they will be helpful. – johnshen64 Jul 23 '13 at 17:38
How can I see this shell history – Bob Yon Jul 23 '13 at 18:31
that would depend on what shell each user uses. You need to go to each user's home directory to find out with ls -la. for example, if bash, then it should be .bash_history. Other shells have equivalent files to keep history. I am assuming it is not a security audit, as shell history can be turned off entirely or erased and is thus not a good auditing tool. – johnshen64 Jul 23 '13 at 18:38

If you have pacct enabled, then you can use lastcomm to get the times if the last commands run.

share|improve this answer

What you could do for the future, is get some process to monitor your running shell scripts periodically. For example, you could program a script in Perl, and set it to run from a crontab, and have it get the running shell scripts from the command "ps aux", and write this data to a log file :)

The downside to this is that it would only run once a minute at most so short-running scripts could be missed. It's a good way to get a "general activity level" but won't help you audit every single shell command that was run.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.