how to check what user did in last login

[malayzorro]

Hi..

I wonder if I can check any log that will describe things:
1- any app. been installed
2- any patch been updated

so, easy to check any last activity done by other users.

 

[KenCunningham]

Which shell? If ksh, try looking at .sh_history.

I want to be good, is that not enough?

 

[blainepruitt]

Unfortunately without some sort of auditing enabled this sort of information is unlikely to exist. As Ken stated your best bet will depend on the user's shell. Try looking in the user's home directory for the following files:

.bash_history
.sh_history

These are the history files created for ksh and bash. Aside from that your best bet is the wtmpx logs. To view them run the command: last | more

Try comparing the timestamps of any altered files with the login times for a particular user.