8

Is there a way to find a log of all the commands that have been run by a user on Ubuntu 11.10 Server? I need to find out what my friend ran to install a program.

9

If you use something like bash as a command interpreter, you could check the history.

more /home/user/.bash_history
  • How can i check the history with time-stamp? When each commands were used? – user25165 Jul 2 '13 at 8:13
  • 1
    Under what conditions are commands added to the log? I've read that the commands are only added to the log when you exit. I noticed my commands weren't being added so I thought maybe it was because I was being kicked rather than exiting. Then I tried existing and even the they weren't added. I ask because I'm only seeing a few commands from early on in my new Ubuntu installation. – mikato Jul 16 '14 at 17:38
-2

Follow these instructions (revised from this answer).

  1. Modify the /etc/bash.bashrc

  2. Append the below line the end of that file

     export PROMPT_COMMAND='RETRN_VAL=$?;logger -p local6.debug "$(whoami) [$$]: $(history 1 | sed "s/[ ][0-9]+[ ]//" ) [$RETRN_VAL]"'
    
  3. Create a new file

    /etc/rsyslog.d/bash.conf
    
  4. Add the line to the file

    local6.*    /var/log/commands.log
    
  5. Add line to the file /etc/logrotate.d/rsyslog .

    Nearby:

    /var/log/mail.warn
    /var/log/mail.err
    [...]
    /var/log/message   
    

    Add this

    /var/log/commands.log
    
  6. Restart the rsyslog.

    sudo service rsyslog restart
    

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.