Re: History and Last cleared ??

From: nobodaddy (nobodaddyNO@SPAMinbox.lv)
Date: 04/05/03 

From: nobodaddy <nobodaddyNO@SPAMinbox.lv>
Date: Fri, 04 Apr 2003 22:25:24 GMT

Jake wrote:

> When I do a "history" and "last" on one of my servers I noticed it was
> emptied. Is it supposed to keep these entries into eternity or do they
> get
> wiped out periodically? Is it easily corruptable?
>
> I'm trying to figure out if this is a sign of someone hacking into my box.

The "last" log can get cronified, as others have noted, but the absence of
any history, esp in root acct, is highly suspect. This is never subject to
cron, AFAIK. Unless you deleted the $HISTFILE and changed the values of
the myriad environment variables ($HISTSIZE, HISTFILESIZE, etc), there's no
reason for history to vanish.

IMVHO, if you can't think of a logical reason that command history should
disappear, it's probably a good idea to disconnect and investigate further
(find trojans/rootkit). 

-- 
The other day a dog peed on me.  A bad sign.
- H.L. Mencken

Relevant Pages

  • Re: Common History across Shell
    ... When the shell starts up, the history is initialized from the file ... named by the value of HISTFILE is truncated, if necessary, to contain ... history in file from each session *after* the particular session ...
    (comp.unix.shell)
  • Re: [SLE] BASH History
    ... Randall wrote regarding 'BASH History' on Sat, ... > interactive BASH shells and one root shell running. ... > history file, and I end up with only one of those shells' history. ... file named by the value of HISTFILE is truncated, ...
    (SuSE)
  • Re: Common History across Shell
    ... Note the history of your session won't be ... When the shell starts up, the history is initialized from the file ... named by the value of HISTFILE is truncated, if necessary, to contain ... Builtin Commands), the lines are appended to the history file, ...
    (comp.unix.shell)
  • Re: Man you guys are boring...
    ... Oh hell, ... consigned to the history of the web for all eternity. ... That was a fun troll on another newsgroup ...
    (rec.games.miniatures.warhammer)
  • common history in bash
    ... I was trying to get multiple bash sessions to share a common history. ... The logic being that after the command was appended to the HISTFILE, ...
    (comp.unix.shell)
Loading