I was wondering if it is at all possible to find out when the computer was switched on, what files where accessed what folders were opened, what programs run and when the computer was resumed and put back to sleep (just like in the movies).
I know this isn't that important but it would be cool to know.
Best Answer
When was the machine turned on:
Example from my notebook:
That is current time, uptime, amount of users and the load average.
What programs run:
Command line
GUI - System monitor (
dash
,system monitor
):When the computer was resumed or sleep
what folders were opened
what files where accessed
None of these I know a command for. Natty has
activity journal
for files.Other interesting things...
To see when the users logged in the last time:
lastlog
.Login failure:
faillog
.last
,lastlog
,faillog
make use of log file/var/log/wtmp
(last),/var/log/lastlog
and/var/log/faillog
. If those are not active you will not get any result.lsof
shows a list of currently open files.It can do alot of checks on a lot of options. From
man lsof
: