Where is system information / activity collected ?

[supernicky]

Hello everybody, I registered here because one of our customers is escalating a problem which he experienced once, and unfortunately I should find out why this problem occured.

So, at a special day and time, somebody just shut down our program, as it seems.

If the OS was windows, I would know how to find out who did that, but as it is Linux I am really helpless.

By now I have the file /var/log/messages of the customers system which is not very detailed.

Can somebody please tell me if there is another possibility to find out who was logged on to that system at a special time ?

And what he did ?

Thank you,
Nicole

[hazel]

You might find the last command useful. It has a -t option which (in theory) allows you to find out who was logged in at a particular time.

The problem is that graphical logins are not always listed in the relevant file (/var/log/wtmp). This depends on how the system administrator set things up.

[supernicky]

Thank you very much for the reply !
I forwarded the information (it is a little bit complicated, in a big enterprise and the customer is also a big enterprise).
Let's hope that we find out -something-, this case is getting on my nerves.

BR Nicole

[arcull]

If you type

history

in terminal you may get history of commands issued via terminal by that user. If not, evbug module should certainly log every key stroke, however I don't know how to monitor "gui" actions. Hope this helps a bit.