I don't think it's a port number. This is RHEL7 and I'm not certain what process is updating the log. I'll see if it's auditd tomorrow. The standard isn't to name it commands.log, but I can't find anything in RHEL7 which defaults to this.
I'm just a bit frustrated, because I don't want to...
That just shows me who's logged on... I'm just suspicious that another admin doctored the log.
I have an entry for a command listed as occurring on the 14th listed as being done on the 19th as well.
I see"
Jan 15 08:23:13 server bob root 3281 ./script_to_run
Later, today I see
Jan 19 08:13:53 server pat root 3281 ./script_to_run
I don't know what 3281 is, but I'm suspicious, because it says I did this thing, but I didn't "I" being the user "pat" I'm not able to find a complete...