cat /var/log/auth.log |grep install
cat /var/log/auth.log |grep adduser
cat /var/log/auth.log |grep visudo
cat /var/log/auth.log |grep vi
cat /home/it-admin/.bash_history
cat /home/it-admin/.viminfo
ls -la /bin/os-update
cat /bin/os-update.sh
cat /etc/crontab