I have two users on my Ubuntu desktop. I want to audit the commands that these two users execute each day. I am not talking about the History command, because I need to know the commands each user executed specifically.

I cannot log in as or su to either of these users.

Is there any way I can do this?

  • 1
    You could tee the log to syslog and then have a remote daemon forward all the syslog to another machine that you can use. I guess you will have su to the user atleast once and setup the bash_profile/bashrc to forward the history to syslog.
    – kapad
    Mar 3, 2014 at 22:07

1 Answer 1


Install acct :

sudo apt-get install acct

For example: as a client user I execute the rm command:

client@client:~$ rm /mnt/test

Now from my root account (or any account) I can know when this user executed the rm command:

root@client:~# lastcomm client | grep rm
rm                     client   pts/0            0.00 secs  Tue Mar   4 01:53

As we see here the it displays the time.

What if I want to know all the commands that client executed?

You can type lastcomm client

If you have many users just change the client to the users you have: it will display commands executed by each, along with the time.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.