5

On one of our servers, yum history reports:

[tschmidt@sl-was01p ~]$ sudo yum history
Loaded plugins: product-id, search-disabled-repos, security, subscription-
              : manager
ID     | Login user               | Date and time    | Action(s)      | Altered
-------------------------------------------------------------------------------
    30 | <dlewandowski>           | 2016-10-07 11:18 | E, I, U        |   38 EE
    29 | <dlewandowski>           | 2016-09-16 16:13 | Erase          |    3   
[...]

But the reported login user swears he wasn't near the machine (physically or logically) anywhere near that time, and last seems to support this:

[tschmidt@sl-was01p ~]$ last|grep dle
dlewando pts/0        al-dlewandowski. Tue Oct 11 09:01 - 09:23  (00:22)    
dlewando pts/0        al-dlewandowski. Tue Oct 11 08:37 - 08:40  (00:02)    
dlewando pts/1        al-dlewandowski. Tue Oct  4 11:04 - 11:09  (00:04)    
dlewando pts/0        al-dlewandowski. Tue Oct  4 10:50 - 11:11  (00:21)    

Syslog doesn't report any sudo activity from or to that user around the yum activity in question, either.

I'd like to find out why yum history reports that apparently incorrect user. Where does it pull that information from? The username does not appear anywhere in /var/log/yum.log.

  • Do you somehow have multiple users with the same uid? – Michael Hampton Oct 11 '16 at 19:03
  • I sure hope I don't. :-) All "real" users on the system (including the one in question as well as myself) are authenticated via sssd against a MS AD domain and we make sure every AD user gets a unique global Linux UID. But that raises an interesting secondary question: does yum store the login name, or does it store the UID and resolve that to a name via nsswhen I run yum history? – Tilman Schmidt Oct 11 '16 at 19:21
  • After a little more research, I updated my answer. Hopefully it provides you with the info you need. – K Richardson Oct 13 '16 at 12:54
  • As to the other portion of your question. Did you ever find out what happened? My next item to try (you probably already did this) would be to run last -t 20161007111800 and see who actually was logged in at the time. Then maybe that information could be used with /var/log/secure to give further information. – K Richardson Oct 18 '16 at 22:07
  • Is VNC (or something similar) running in your environment? I was able to reproduce the problem that you show above by logging in, starting up VNC, logging out (which updates wtmp, closing out the login session), then connecting up to the still running VNC session. Then sudo yum install. Now last reports that I had no active login sessions at the time that yum reports the transaction. Hope this helps! – K Richardson Oct 18 '16 at 22:21
2

Yum commands record the user that logged into the machine (login name). You can see your current session’s login name with logname. su (with or without sudo) will start a new shell, but will not change the login name.

If you run yum history stats {TRANSACTION ID}, it will tell you the location of the SQLite database file where the yum transaction data is stored. You can open this file with sqlite3 to find out all sorts of information. A table called trans_beg has a field called loginuid.

[root ~]# yum history stats 4
Loaded plugins: amazon-id, rhui-lb, search-disabled-repos
File        : //var/lib/yum/history/history-2015-11-10.sqlite
..
[root ~]# sqlite3 //var/lib/yum/history/history-2015-11-10.sqlite
SQLite version 3.7.17 2013-05-20 00:56:22
Enter ".help" for instructions
Enter SQL statements terminated with a ";"
sqlite> .schema
CREATE TABLE trans_beg (
     tid INTEGER PRIMARY KEY,
     timestamp INTEGER NOT NULL, rpmdb_version TEXT NOT NULL,
     loginuid INTEGER);
  • How does this explain the result he got? If it records the user that logged into the machine, but that user wasn't logged into the machine at the time, how did it get recorded? – Barmar Oct 18 '16 at 18:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.