It is recommended that you log user activity using process accounting. Process accounting allows you to view every command executed by a user including CPU and memory time. With process accounting sys admin always find out which command executed at what time

The psacct package contains several utilities for monitoring process activities, including ac, lastcomm, accton and sa.

• The ac command displays statistics about how long users have been logged on.
• The lastcomm command displays information about previous executed commands.
• The accton command turns process accounting on or off.
• The sa command summarizes information about previously executed commmands.

Task: Install psacct or acct package

# yum install psacct

Task: Start psacct/acct service

You need to start psacct service manually. Type the following two commands to create /var/account/pacct file and start services:
# chkconfig psacct on
# /etc/init.d/psacct start

Now let us see how to utilize these utilities to monitor user commands and time.

Task: Display statistics about users’ connect time

ac command prints out a report of connect time in hours based on the logins/logouts. A total is also printed out. If you type ac without any argument it will display total connect time:
$ ac

Output:

total       95.08

Display totals for each day rather than just one big total at the end:
$ ac -d

Output:

Nov  1  total        8.65
Nov  2  total        5.70
Nov  3  total       13.43
Nov  4  total        6.24
Nov  5  total       10.70
Nov  6  total        6.70
Nov  7  total       10.30
.....
..
...
Nov 12  total        3.42
Nov 13  total        4.55
Today   total        0.52

Display time totals for each user in addition to the usual everything-lumped-into-one value:
$ ac -p

Output:

        vivek                             87.49
        root                                 7.63
        total       95.11

Task: find out information about previously executed user commands

Use lastcomm command which print out information about previously executed commands. You can search command using usernames, tty names, or by command names itself.

Display command executed by vivek user:
$ lastcomm vivek

Output:

userhelper        S   X vivek  pts/0      0.00 secs Mon Nov 13 23:58
userhelper        S     vivek  pts/0      0.00 secs Mon Nov 13 23:45
rpmq                    vivek  pts/0      0.01 secs Mon Nov 13 23:45
rpmq                    vivek  pts/0      0.00 secs Mon Nov 13 23:45
rpmq                    vivek  pts/0      0.01 secs Mon Nov 13 23:45
gcc                     vivek  pts/0      0.00 secs Mon Nov 13 23:45
which                   vivek  pts/0      0.00 secs Mon Nov 13 23:44
bash               F    vivek  pts/0      0.00 secs Mon Nov 13 23:44
ls                      vivek  pts/0      0.00 secs Mon Nov 13 23:43
rm                      vivek  pts/0      0.00 secs Mon Nov 13 23:43
vi                      vivek  pts/0      0.00 secs Mon Nov 13 23:43
ping              S     vivek  pts/0      0.00 secs Mon Nov 13 23:42
ping              S     vivek  pts/0      0.00 secs Mon Nov 13 23:42
ping              S     vivek  pts/0      0.00 secs Mon Nov 13 23:42
cat                     vivek  pts/0      0.00 secs Mon Nov 13 23:42
netstat                 vivek  pts/0      0.07 secs Mon Nov 13 23:42
su                S     vivek  pts/0      0.00 secs Mon Nov 13 23:38

For each entry the following information is printed. Take example of first output line:
userhelper S X vivek pts/0 0.00 secs Mon Nov 13 23:58
Where,

• userhelper is command name of the process
• S and X are flags, as recorded by the system accounting routines. Following is the meaning of each flag:
• S — command executed by super-user
• F — command executed after a fork but without a following exec
• D — command terminated with the generation of a core file
• X — command was terminated with the signal SIGTERM
• vivek the name of the user who ran the process
• prts/0 terminal name
• 0.00 secs – time the process exited

Search the accounting logs by command name:
$ lastcomm rm
$ lastcomm passwd

Output:

rm                S     root     pts/0      0.00 secs Tue Nov 14 00:39
rm                S     root     pts/0      0.00 secs Tue Nov 14 00:39
rm                S     root     pts/0      0.00 secs Tue Nov 14 00:38
rm                S     root     pts/0      0.00 secs Tue Nov 14 00:38
rm                S     root     pts/0      0.00 secs Tue Nov 14 00:36
rm                S     root     pts/0      0.00 secs Tue Nov 14 00:36
rm                S     root     pts/0      0.00 secs Tue Nov 14 00:35
rm                S     root     pts/0      0.00 secs Tue Nov 14 00:35
rm                      vivek    pts/0      0.00 secs Tue Nov 14 00:30
rm                      vivek    pts/1      0.00 secs Tue Nov 14 00:30
rm                      vivek    pts/1      0.00 secs Tue Nov 14 00:29
rm                      vivek    pts/1      0.00 secs Tue Nov 14 00:29

Search the accounting logs by terminal name pts/1
$ lastcomm pts/1

Task: summarizes accounting information

Use sa command to print summarizes information about previously executed commands. In addition, it condenses this data into a summary file named savacct which contains the number of times the command was called and the system resources used. The information can also be summarized on a per-user basis; sa will save this iinformation into a file named usracct.
# sa

Output:

     579     222.81re       0.16cp     7220k
       4       0.36re       0.12cp    31156k   up2date
       8       0.02re       0.02cp    16976k   rpmq
       8       0.01re       0.01cp     2148k   netstat
      11       0.04re       0.00cp     8463k   grep
      18     100.71re       0.00cp    11111k   ***other*
       8       0.00re       0.00cp    14500k   troff
       5      12.32re       0.00cp    10696k   smtpd
       2       8.46re       0.00cp    13510k   bash
       8       9.52re       0.00cp     1018k   less

Take example of first line:
4 0.36re 0.12cp 31156k up2date
Where,

• 0.36re ”real time” in wall clock minutes
• 0.12cp sum of system and user time in cpu minutes
• 31156k cpu-time averaged core usage, in 1k units
• up2date command name

Display output per-user:
# sa -u

Output:

root       0.00 cpu      595k mem accton
root       0.00 cpu    12488k mem initlog
root       0.00 cpu    12488k mem initlog
root       0.00 cpu    12482k mem touch
root       0.00 cpu    13226k mem psacct
root       0.00 cpu      595k mem consoletype
root       0.00 cpu    13192k mem psacct           *
root       0.00 cpu    13226k mem psacct
root       0.00 cpu    12492k mem chkconfig
postfix    0.02 cpu    10696k mem smtpd
vivek      0.00 cpu    19328k mem userhelper
vivek      0.00 cpu    13018k mem id
vivek      0.00 cpu    13460k mem bash             *
lighttpd   0.00 cpu    48240k mem php              *

Display the number of processes and number of CPU minutes on a per-user basis
# sa -m

Output:

                                      667     231.96re       0.17cp     7471k
root                                  544      51.61re       0.16cp     7174k
vivek                                 103      17.43re       0.01cp     8228k
postfix                                18     162.92re       0.00cp     7529k
lighttpd                                2       0.00re       0.00cp    48536k

Task: Find out who is eating CPU

By looking at re, k, cp/cpu (see above for output explanation) time you can find out suspicious activity or the name of user/command who is eating up all CPU. An increase in CPU/memory usage (command) is indication of problem.

Please note that above commands and packages also available on other UNIX like oses such as Sun Solaris and *BSD oses.

Reference:
http://www.cyberciti.biz/tips/howto-log-user-activity-using-process-accounting.html

AuthUserFile /path/to/passwd
AuthName “Authorization Required”
AuthType Basic
require valid-user

Satisfy Any
Allow from all

Reference:

http://stackoverflow.com/questions/3865374/http-basic-auth-exclude-single-file

RewriteRule ^/products/index\.html$ /products/ [R=301]

Run /sbin/service httpd reload for it to make effect

Installing ClamAV (64-bit)
1. Download the file using wget
$ sudo wget http://pkgs.repoforge.org/clamav/clamav-0.97.3-1.el5.rf.x86_64.rpm
$ sudo wget http://pkgs.repoforge.org/clamav/clamav-db-0.97.3-1.el5.rf.x86_64.rpm

2. Install the packages
$ sudo rpm -ivh clamav-*.rpm

Now that we have it installed there are a few things we need to learn about it and do. First thing is to update the definitions. We achieve this by running the command freshclam. Freshclam requires and Internet connection to download and update the virus definitions. All you have to do is type the command, press enter and voila! We are up to date.

Running Antivirus Scanning Manually
To run antivirus and print infected files on /home:
clamscan -ri /home

To run antivirus and remove infected files on /home:
clamscan -ri –remove /home

Automating Antivirus Scanning
It is a good security practice to have regular antivirus scanning on the system.
To automate the scanning, just edit /etc/crontab and add the following at the bottom:

0 5 * * * root clamscan -ri /|mail -s “ClamScan Result for servername” youremail@address.com

This will make ClamAV to run daily at 5.00 AM and send the scan result to youremail@address.com.
The anti virus database has been set to be updated daily  so there is no need to configure it.

Reference:
ClamAV on CentOS 5.5

function Get-WebServiceConnections()
{
  $results = @{}
  $perfmon = new-object System.Diagnostics.PerformanceCounter
  $perfmon.CategoryName = "Web Service"

  $perfmon.CounterName = "Current Connections"

  $cat = new-object System.Diagnostics.PerformanceCounterCategory("Web Service")
  $instances = $cat.GetInstanceNames()

  foreach ($instance in $instances)

  {
    $perfmon.InstanceName = $instance
    $results.Add($instance, $perfmon.NextValue())
  }
write-output $results
}

At the command prompt:

net start WAS

Note: WAS is the Windows Process Activation Service (btw, pretty silly service name, as it’s nigh impossible to google for WAS).

Run appcmd list wp:

C:\Windows\system32>%windir%/system32/inetsrv/appcmd list wp
WP “5716″ (applicationPool:DefaultAppPool)
WP “968″ (applicationPool:MyOtherAppPool)
WP “5836″ (applicationPool:TheThirdAppPool)

The number in the results is the process ID in the results is the Windows process ID (PID).

Now in Windows Task Manager, after having enabled the PID column in View>Select Columns… you can identify the offending w3wp.exe by its PID.

Reference:
Identify which w3wp.exe belongs to which Application Pool in IIS7

LoadModule rewrite_module modules/mod_rewrite.so

Backup httpd.conf before you add the following:

Options +FollowSymlinks
RewriteEngine on
RewriteCond %{REQUEST_FILENAME} !^(.+)\.png$
RewriteCond %{REQUEST_FILENAME} !^(.+)\.jpg$
RewriteCond %{REQUEST_FILENAME} !^(.+)\.gif$
RewriteCond %{SERVER_PORT} !^443$
RewriteRule ^/(.*) https://%{SERVER_NAME}/$1 [L,R]

Reference:

http://corz.org/serv/tricks/htaccess2.php

http://wiki.apache.org/httpd/RewriteCond

http://www.whoopis.com/howtos/apache-rewrite.html

select distinct top 10
substring(t.text, (s.statement_start_offset/2)+1, (((case s.statement_end_offset when -1 then datalength(t.text) else s.statement_end_offset end) – s.statement_start_offset)/2) + 1) as SqlText
, (case when s.statement_start_offset > 0 then substring(t.text, 0, (s.statement_start_offset/2)+1) else ” end) as SqlParameters
, s.execution_count as ExecutionCount
, (s.max_elapsed_time/1000) as MaxElapsedTimeMs
, (s.min_elapsed_time/1000) as MinElapsedTimeMs
, isnull((s.total_elapsed_time/1000) / nullif(s.execution_count, 0), 0) as AvgElapsedTimeMs
, s.creation_time as LogCreatedOn
, s.last_execution_time as LastExecutionTime
, isnull(s.execution_count / nullif(datediff(s, s.creation_time, getdate()), 0), 0) as FrequencyPerSec
from
sys.dm_exec_query_stats as s
cross apply
sys.dm_exec_sql_text(s.sql_handle) as t
order by
isnull((s.total_elapsed_time/1000) / nullif(s.execution_count, 0), 0) desc

Reference:
dans.blog

If you encounter an error, you may need to deploy solution (WSP). Please see http://sharepointfoundation2010.blogspot.com/2010/09/how-to-deploy-solution-wsp-from.html
Copying web.config may also necessary.

select * from table WHERE creation_date BETWEEN STR_TO_DATE('01-10-2011', '%d-%m-%Y') AND STR_TO_DATE('31-10-2011', '%d-%m-%Y')

Query to  select data between 01-11-2011 0900 hours and 02-11-2011 0800 hours

select * from table WHERE creation_date BETWEEN STR_TO_DATE('01-11-2011 09:00:00', '%d-%m-%Y %H:%i:%s') AND STR_TO_DATE('02-11-2011 08:00:00', '%d-%m-%Y %H:%i:%s')