command to check who edit the file ...

[h3nd]

Hi guys,

I just need to find out who is the last person that edit the file ?

is there any command to check that ?

Cheers,

 

[Annihilannic]

No, not unless you have some kind of extra auditing enabled.

Annihilannic.

 

[Annihilannic]

You could try searching through users' .*_history files though...?

Annihilannic.

 

[columb]

To back up Annihilannic what we do (under AIX, but I believe this also works under RedHat Linux) is to create a directory /var/hist, chmod it 777 and add to /etc/profile

tty >/dev/null 2>&1 && { \
  export HISTFILE=/var/hist/$(who am i|awk '{print $1}')_pts$(basename $(tty))_$(date +"%d.%m.%y"); \
  touch $HISTFILE 2>/dev/null; \
  chmod 666 $HISTFILE 2>/dev/null; \
  export HISTSIZE=50000; }

This means that every login has an individual history file which is dated and tied to login and a tty. It remains theirs whether they su or not, so you can tie down exactly who did what, but in time terms not closer than the nearest day.

Ceci n'est pas une signature
Columb Healy

 

[h3nd]

Thx Anni,

But how can I access someone's hist profile. Because normally they hist profile is in its home directory.

columb,

in Red hat there's no /var/hist directory..
there is /var but not /hist/ could you give me more clue pls ?

 

[Annihilannic]

I was making the presumption that you are the system administrator and that you have root access... in which case you should be able to read the users' shell histories.

You would need to make the /var/hist directory yourself to use Columb's suggestion.

Annihilannic.

 

[Salem]

Enable accounting and use lastcomm ?

http://www.gnu.org/software/acct/manual/html_node/lastcomm.html

--