If they used sudo, then you'd be able to see it in /var/log/secure.
Otherwise, if they logged in as root, you can see all root logins via:
last -da | grep root
The latter won't tell you what they did, only:
history | less
will show you recent commands, but on most systems that's limited to the
last session.
If you want to log all root-level activity in the future, I'd recommend
installing auditd and getting that setup--it'll watch file changes, and log
who changed what and when they did so.
On Sun, Jan 4, 2015 at 9:39 PM, James Mcphee <
jmcphe@gmail.com> wrote:
> rpm -qid will give you the install date at least.
>
> On Sun, Jan 4, 2015 at 8:09 PM, George Toft <george@georgetoft.com> wrote:
>
>> ls -lc might give you better insight on package install time. Also rpm
>> -qa | grep git, then rpm -qi <package name>
>>
>> Regards,
>>
>> George Toft
>>
>> On 12/31/2014 6:13 AM, Keith Smith wrote:
>>
>>>
>>> Hi,
>>>
>>> I am trying to determine who installed GIT and when GIT was installed
>>> and what repository it came from.
>>>
>>> The date stamp on /usr/share/git-core says Oct 31 16:55. The server did
>>> not exist until early November.
>>>
>>> Thanks!!
>>>
>>> Keith
>>>
>>>
>>>
>> ---------------------------------------------------
>> PLUG-discuss mailing list - PLUG-discuss@lists.phxlinux.org
>> To subscribe, unsubscribe, or to change your mail settings:
>> http://lists.phxlinux.org/mailman/listinfo/plug-discuss
>>
>
>
>
> --
> James McPhee
> jmcphe@gmail.com
>
> ---------------------------------------------------
> PLUG-discuss mailing list - PLUG-discuss@lists.phxlinux.org
> To subscribe, unsubscribe, or to change your mail settings:
> http://lists.phxlinux.org/mailman/listinfo/plug-discuss
>
--
Todd Millecam
---------------------------------------------------
PLUG-discuss mailing list -
PLUG-discuss@lists.phxlinux.org
To subscribe, unsubscribe, or to change your mail settings:
http://lists.phxlinux.org/mailman/listinfo/plug-discuss
(text/plain)