From owner-freebsd-questions Sun Dec 31 8: 6:42 2000 From owner-freebsd-questions@FreeBSD.ORG Sun Dec 31 08:06:38 2000 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from magellan.palisadesys.com (magellan.palisadesys.com [192.188.162.211]) by hub.freebsd.org (Postfix) with ESMTP id 8177E37B400; Sun, 31 Dec 2000 08:06:37 -0800 (PST) Received: from localhost (ghelmer@localhost) by magellan.palisadesys.com (8.11.0/8.11.0) with ESMTP id eBVG6PS17955; Sun, 31 Dec 2000 10:06:25 -0600 Date: Sun, 31 Dec 2000 10:06:25 -0600 (CST) From: Guy Helmer To: Jahanur R Subedar Cc: freebsd-questions@FreeBSD.ORG, freebsd-isp@FreeBSD.ORG Subject: Re: How to find the time.... In-Reply-To: Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG On Sun, 31 Dec 2000, Jahanur R Subedar wrote: > Hi Folks, > I am trying to find the time of when a particular command was executed. > We ussually use c shell and the history command only tells the what > command was executed. It is important for us to find the time of a > particular user when it was executed. Is there any log file foruser > activity or this kind. > Or Is there anyway to find this? If you have process accounting enabled (accounting="YES" in /etc/rc.conf), each program executed is logged in the binary file /var/account/acct (which is automatically rotated dailiy). Information in the acct file may be listed with the lastcomm(1) command. Note that the information may not be as trustworthy as it appears. For example, a user may create a symbolic link pointing to a program, and the program name recorded in lastcomm will be the name of the link, not that name of the actual program executed. Guy -- Guy Helmer, Ph.D. Sr. Software Engineer, Palisade Systems --- ghelmer@palisadesys.com http://www.palisadesys.com/~ghelmer To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message