A brief history of the admins time

Again a rather short entry. Quite often one question is which privileged tasks the admins did on the system. Since 11.4 there is a simple command to find out. The information of this command is yet another usecase of the auditing subsystem.

root@batou:~# admhist -d "today"
2019-03-02 06:59:08 jmoekamp /usr/sbin/zfs zfs create rpool/export/test1

The -v option yields some additional information like the hostname and the working directory.

root@batou:~# admhist -d "today" -v
2019-03-02 06:59:08 jmoekamp@batou cwd=/root /usr/sbin/zfs zfs create rpool/export/test1

Do you want to learn more?

docs.oracle.com - man page of admhist (8)