Something already happened on the server (I can’t say what). At this point we are just pointing who did what. If we hadn’t turned on logging, we can’t get the needed information? Or is something turned on by default?
Anything would be useful.
Where to look if any logging was enabled?
How to find out what commands were issued by ‘built in’ users such as root, toor, operator, shhd, www, … and additional created users such as Alice, Bob, ….? Is there a place where all issued commands are stored?
How to find them out?
Anything would be useful.
Where to look if any logging was enabled?
How to find out what commands were issued by ‘built in’ users such as root, toor, operator, shhd, www, … and additional created users such as Alice, Bob, ….? Is there a place where all issued commands are stored?
How to find them out?
