what log file can tell me what user

[adva]

what log file can tell me what user did what act on my machine (in the last 24 hours or so)?

 

[KenCunningham]

Try .sh_history within the home directories of your users. If it exists, this MIGHT help pin down the culprit if that's the right word). Use more .sh_history rather than pg as the latter doesn't seem happy with listing .sh_history.

If this is no help (because .sh_history isn't there, or doesn't give you a clue), post back. HTH.

 

[adva]

hello.
first TNX.
the info i need is tha act on the machine not of specific user
any idea?

 

[KenCunningham]

Sorry, there isn't a specific answer here, but if you're sure that the activity in question wasn't kicked off by cron or similar, then the .sh_history files for individual users are probably the only other option, they list commands typed at the keyboard and will include commands which had an effect on the machine, if approriate. Can you give any indication (even in general terms) as to the kind of thing which was affected, as this might give more of a clue as to what we're looking for. Thanks.

 

[trunix]

You would need to switch system accounting on using the accton command. acctcms specifically summarizes command usage. Take a look at the accton man page. Bear in mind that accounting can produce very large files.