AIX session history?

[TravisBickle77]

Is it possible to find a session history on the AIX OS? I am running AIX 4.3. The reason for wanting the session history is that on 12/17/03 at 09:58:00 the contents of a certain .env file were wiped out. I wanted to see which user may have caused the problem. I know which login was probably used, but I was hoping that in a session history, I could tell from which ip address the session was initiated and thereby locate the computer on the network.

Thank-you,

TB

 

[bi]

The command last will give you who was logged in when on a system. However, if the person did an su - username to the suspected login, you won't see that in the results of last. If you are keeping an sulog, that may give you some clues as well.

If the user is using the Korn shell, there will automatically be a .sh_history file generated in the user's home directory. However, there are no timestamps for when a command was executed. (Other shells also can generate a history file, too.)

 

[TravisBickle77]

Thank-you, that was perfect! I was able to find which machine the session was started from, and I will probably restore a copy of the .sh_history file to find the exact commands issued from that session.

-TB