unautherized/illegal use of ncat/nmap

[h4x0r4f33dom]

hi,
as a sysadmin there's one important thing i need to know. what are the file i need to look at to reveal if a user on my sys uses NetCat, NMap or any other port scanner?

thx

[Ant P.]

Your own emerge logs, since you'll be the one to install those tools assuming you're competent enough to mount home noexec.

Edit, since your followup posts make it clear you're not the sysadmin in question: yes, you are being stupid enough to actually get caught.