What shell scripts have run

Question

Is there any way to determine what shell scripts ran within a certain time frame? I.e. I need to know all the shell scripts that ran yesterday between 2:00 an 5:00.

***WHY***? [What specific problem are you trying to solve?](http://meta.stackexchange.com/questions/66377/what-is-the-xy-problem) — voretaq7, Jul 23 '13 at 17:28
You need to give way more information about your system and what kind of logging is in place before this can be answered. — superuser0, Jul 23 '13 at 17:29

score 2 · Answer 1 · answered Jul 23 '13 at 17:19

2

There is no such recording in general, unless the scripts systematically logs to system logs when they run, or they were run as cron jobs. You can look at shell history for all the users, but these have no time recorded.

answered Jul 23 '13 at 17:19

johnshen64

5,865
24
17

`history` _does_ have time recorded if you want it to. Just set `HISTTIMEFORMAT="%FT%T%z "`. – dawud Jul 23 '13 at 17:35
ah yes, thanks. i meant by default it does not. – johnshen64 Jul 23 '13 at 17:36
1

also, if you set up sudo, then any command ran with sudo will be logged. since these are likely of most concern, they will be helpful. – johnshen64 Jul 23 '13 at 17:38
How can I see this shell history – Bob Yon Jul 23 '13 at 18:31
that would depend on what shell each user uses. You need to go to each user's home directory to find out with ls -la. for example, if bash, then it should be .bash_history. Other shells have equivalent files to keep history. I am assuming it is not a security audit, as shell history can be turned off entirely or erased and is thus not a good auditing tool. – johnshen64 Jul 23 '13 at 18:38
not a security audit. Im trying to find all shell scripts running on the head node of a grid so I can get them moved to a compute node. All of them SHOULD be submitted with the same user from Autosys, our job scheduler. – Bob Yon Jul 23 '13 at 18:40

score 0 · Answer 2 · answered Jul 23 '13 at 21:39

0

If you have pacct enabled, then you can use lastcomm to get the times if the last commands run.

answered Jul 23 '13 at 21:39

toppledwagon

4,245
25
15

score -1 · Answer 3 · edited Jul 24 '13 at 00:11

What you could do for the future, is get some process to monitor your running shell scripts periodically. For example, you could program a script in Perl, and set it to run from a crontab, and have it get the running shell scripts from the command "ps aux", and write this data to a log file :)

The downside to this is that it would only run once a minute at most so short-running scripts could be missed. It's a good way to get a "general activity level" but won't help you audit every single shell command that was run.

What shell scripts have run

3 Answers3