SUMMARY: command history + sulog

From: Anja Mitchell (
Date: Wed Jan 21 1998 - 17:25:59 CST


my original question was:
>We've got a Sparc20 with Solaris 2.5 and all our users run /bin/ksh.
>I would like to know whether there is a way of getting a user's command
>history time stamped in the .sh_history file (or anywhere else).
>Also, in the /var/adm/sulog file info of who did the su command is kept,
>how can I tell when a user logged out? I know that the "last" command gives
>the login and logoff time of users, but only if they were logged in
>directly and not with "su".

Thanks to:
JOSEPH AAJ Chackompally <> (Damir Delija)
FreakaZoid <>
Joseph S D Yao <>

It was suggested that I turn accounting on and use "acctcom" to have a look
at the /var/adm/pacct file, which should give me timestamped details of a
users command history. I have done this and it works fine, except it only
gives the general command which was run, and no details, eg. for copying a
file "cp file1 file2" it will only give me "cp".

I could write a small script that will correlate the ports of a user that
su'ed and when they issued the exit/logout process to see when that person
logged off. Haven't done this yet.

Thanks again to everyone who answered!


Anja Mitchell
Corporate Information Technology
Dept. of Environment & Land Mngmt.
Hobart, Tasmania
Ph: +61-03-62333300
Fax: +61-03-62336775

This archive was generated by hypermail 2.1.2 : Fri Sep 28 2001 - 23:12:29 CDT