On a CentOS 5.x server, I'm troubleshooting an issue and need to determine when a service foo stop command was executed. The logs for the respective service don't indicate this. I only see the command itself in the output for history. This was run from a root shell, not through sudo.

Is there another way to determine when commands were run?

  • 1
    Dupe of superuser.com/questions/279423/… – smithian Oct 23 '12 at 17:03
  • @MikeB Having an idea about the application would allow some alternative methods of determining the end time... lock files, timestamps, etc. This question is unanswerable in this state. – ewwhite Oct 24 '12 at 15:49

CentOS by default does not keep track of when commands are run. As mentioned in a similar Question, you can configure your shell to record it's history of commands with timestamps (but this is not enabled by default). Also, as ewwhite mentions, there may be clues such as lock files, log access/modified timestamps, etc; but none of these are guaranteed easy to read or definitive indicators.

  • Thanks Chris. That's exactly what I wanted to know. Wasn't sure if I was missing some obvious audit logs for all root command actions. – Mike B Oct 24 '12 at 16:02

Try lastcomm, if it's installed and running (check the psacct service) it will give you a report of when processes were executed, and various other details.

It's part of the acct package.

~$ lastcomm
nagios             F    nagios   __         0.10 secs Wed Oct 24 17:16
nagios             F    nagios   __         0.07 secs Wed Oct 24 17:16
nagios             F    nagios   __         0.09 secs Wed Oct 24 17:16
check_http              nagios   __         0.11 secs Wed Oct 24 17:16
perl                    nagios   __         3.70 secs Wed Oct 24 17:16
sh                      nagios   __         0.03 secs Wed Oct 24 17:16
psacct                  root     pts/0      0.08 secs Wed Oct 24 17:16
touch                   root     pts/0      0.02 secs Wed Oct 24 17:16
accton            S     root     pts/0      0.01 secs Wed Oct 24 17:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.