Hi All,
Can anybody tell me, how to trace out user access to the Unix Server Machine, (i,e) I want to find out the user who had executed some commands to alter the cron file.
Regards
Nag
I have not heard of anything like that for HPUX.
You need to restrict access to cron and at on your machine. They're dangerous in the security sense.
Has system auditing been switched on ?
If you go into sam -> Auditing and Security. -> "Events."
It won't ask you if you need to convert to a trusted system. If it doesn't ask this then you should be able to find the information in audited users.. That's if the user your wanting to check has been audited against mind you !
This is on HP-UX, on Solaris you need to enable BSM..
Only other command i can think of is who to see who was on the system the time the cron was modified..
Hope this helps..
Kenny
Thanks a lot Kenny & Jim. But,i have one more question,
How can i view the log files?