If they used sudo, then you'd be able to see it in /var/log/secure.
Otherwise, if they logged in as root, you can see all root logins via:
last -da | grep root
The latter won't tell you what they did, only:
history | less
will show you recent commands, but on most systems that's limited to the last session.

If you want to log all root-level activity in the future, I'd recommend installing auditd and getting that setup--it'll watch file changes, and log who changed what and when they did so.

On Sun, Jan 4, 2015 at 9:39 PM, James Mcphee <jmcphe@gmail.com> wrote:
rpm -qid will give you the install date at least.

On Sun, Jan 4, 2015 at 8:09 PM, George Toft <george@georgetoft.com> wrote:
ls -lc might give you better insight on package install time.  Also rpm -qa | grep git, then rpm -qi <package name>

Regards,

George Toft

On 12/31/2014 6:13 AM, Keith Smith wrote:

Hi,

I am trying to determine who installed GIT and when GIT was installed and what repository it came from.

The date stamp on /usr/share/git-core says Oct 31 16:55.  The server did not exist until early November.

Thanks!!

Keith



---------------------------------------------------
PLUG-discuss mailing list - PLUG-discuss@lists.phxlinux.org
To subscribe, unsubscribe, or to change your mail settings:
http://lists.phxlinux.org/mailman/listinfo/plug-discuss



--
James McPhee
jmcphe@gmail.com

---------------------------------------------------
PLUG-discuss mailing list - PLUG-discuss@lists.phxlinux.org
To subscribe, unsubscribe, or to change your mail settings:
http://lists.phxlinux.org/mailman/listinfo/plug-discuss



--
Todd Millecam