Originally posted by: SystemAdmin

HI ,

Can anyone please help me with the command to check which user has edited a script file in AIX.

Also it would be nice if someone could tell me how to check a given users activity log . i.e the list of commands which the user has used ?

THanks in advance.
Prince.
#AIX-Forum

Originally posted by: tony.evans

Unless you have the auditing system enabled you're unlikely to find out who changed an existing file.

If they created a new file and didn't chown it, then the owner of the file should give you a clue.

You can check commands people ran by checking files such as .sh_history in their home directory, however it's totally unreliable since the file can be modified, removed or ignored and it only holds a certain number of entries.
#AIX-Forum

Originally posted by: SystemAdmin

Thanks for the prompt reply tony.

I have admin rights on the AIX box.
I am not vry sure about the auditing option.
But there are some commands like "whodo -l" and "history" which show u the recent activities of a user.Can ny variations of these commands help know which files the user has edited... ?

Also if the auditing option is enabled then what would be the process to review the activity of a user... ?
Thanks again.
#AIX-Forum

Originally posted by: tony.evans

Those commands won't help. You can try su'ing to the user and running the history command (this may or may not be against your company policy), however the results of that command are based purely on the contents of the .sh_history file which can be edited.

Usually when people want to know what other people did, it's because they did something they should not have. In that case, the .sh_history file isn't reliable enough since it's easy to modify.

I've never turned auditing on, on an AIX server so someone else will have to answer what it provides.

The best you'll be able to do, is find out when the file was last changed, who was logged on at the time (last) and that might help you narrow things down.
#AIX-Forum

Originally posted by: SystemAdmin

Are you seeking an answer for something that happened in past? If you provide more specific details, you'll likely get better answers.

If you're looking to monitor who voluntarily changes things, you'll want to check out some revision control software that will allow an user to check a file in/out for editing and keep track of changes.
#AIX-Forum

Originally posted by: hdkutz

Hello,
use this
http://www.ibm.com/developerworks/aix/library/au-audit/

Cheers,
ku
#AIX-Forum

Originally posted by: grukrz1

in AIX 5.3 you can:

fc -t
when you:

export EXTENDED_HISTORY=ON

you will get output similiar to:

$ fc -t
4681 2008/11/06 21:30:01 :: exit
4682 2008/11/07 07:32:48 :: df
4683 2008/11/07 07:32:51 :: mailx
fc -t -100 # last 100 commands
#AIX-Forum

Originally posted by: SystemAdmin

thanks for ur relies guys ....
Actually there was a DB2 script in AIX , which i edited by mistake.
Earlier when i checked the file using " ll " command , it showed 512 KB occupied space. But i used some commands due to which the file size now shows 0 KB.

I just wanted to know if i can check somehow whether my userID will be refleted as the user who last edited the script.
#AIX-Forum