About your question:
You can check all your received requests to port 80 in your web server logs.
- In Apache, its logs can be found in the following addresses depending on the GNU Linux distribution and version.
About checking your SSH logs, please refer to the following links:
You can check the ALL commands executed by another user by opening the
.bash_history file, located in
/home/<username>/.bash_history, also keep in mind that the user can delete this log file.
tail /var/log/auth.log | grep <username> should give you a user's sudo history.
If the user spawned a shell with
sudo sh, etc, then the commands executed may appear in the history file of the root user, located in
If you want a tool built for this purpose, you can check for sysdig. It is packaged in artful and other Ubuntu releases.
Sydig is an open-source, cross-platform, powerful and flexible system
monitoring, analysis and troubleshooting tool for Linux. It can be
used for system exploration and debugging.
You can execute
sysdig -c spy_users to display every command that users launch interactively as well as every directory users visit.
Also you can use
spy_port to show the data exchanged using the given IP port number.
Hope this helps.