1

I have two users on my Ubuntu desktop. I want to audit the commands that these two users execute each day. I am not talking about the History command, because I need to know the commands each user executed specifically.

I cannot log in as or su to either of these users.

Is there any way I can do this?

1
  • 1
    You could tee the log to syslog and then have a remote daemon forward all the syslog to another machine that you can use. I guess you will have su to the user atleast once and setup the bash_profile/bashrc to forward the history to syslog.
    – kapad
    Mar 3, 2014 at 22:07

1 Answer 1

1

Install acct :

sudo apt-get install acct

For example: as a client user I execute the rm command:

client@client:~$ rm /mnt/test

Now from my root account (or any account) I can know when this user executed the rm command:

root@client:~# lastcomm client | grep rm
rm                     client   pts/0            0.00 secs  Tue Mar   4 01:53

As we see here the it displays the time.

What if I want to know all the commands that client executed?

You can type lastcomm client

If you have many users just change the client to the users you have: it will display commands executed by each, along with the time.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .