Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I have two users on my Ubuntu desktop. I want to audit the commands that these two users execute each day. I am not talking about the History command, because I need to know the commands each user executed specifically.

I cannot log in as or su to either of these users.

Is there any way I can do this?

share|improve this question
1  
You could tee the log to syslog and then have a remote daemon forward all the syslog to another machine that you can use. I guess you will have su to the user atleast once and setup the bash_profile/bashrc to forward the history to syslog. –  kapad Mar 3 at 22:07

1 Answer 1

Install acct :

sudo apt-get install acct

For example: as a client user I execute the rm command:

client@client:~$ rm /mnt/test

Now from my root account (or any account) I can know when this user executed the rm command:

root@client:~# lastcomm client | grep rm
rm                     client   pts/0            0.00 secs  Tue Mar   4 01:53

As we see here the it displays the time.

What if I want to know all the commands that client executed?

You can type lastcomm client

If you have many users just change the client to the users you have: it will display commands executed by each, along with the time.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.