Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can I find out who executed a particular command and which terminal was used to run it?


How can I know particular cmd is executed by whom and to know about my terminal

share|improve this question

migrated from stackoverflow.com Jun 2 '11 at 0:51

This question came from our site for professional and enthusiast programmers.

Can you rephrase this question so it's a little clearer? – Suvesh Pratapa Jun 15 '09 at 4:03
Do you mean, "what ps command should I use to determine who's using scp?" That would be ps -ef | grep scp – Michael Todd Jun 15 '09 at 4:07
possible duplicate of monitoring activity on my computer. – Gilles Jun 2 '11 at 18:17

To see what commands are being executed you use "ps -ef". This will tell you what everyone is doing though which is usually too much information.

To narrow it down to find out who is running a particular command you might add a "grep" filter like so:

ps -ef | grep scp

This will return all scp commands but it might also return the grep command looking for scp and any other commands with the letters scp embedded in them since grep is just matching the string. So you may need to get clever with the expression given to grep (a lot of times you just need to quote it and add a space:

ps -ef | grep "scp "

or even better leverage regular expressions and:

ps -ef | grep "[s]cp "

If you know the user and just want to know what they are running then "ps -fu" is your friend. For instance

ps -fu tom

Which can, of course, be combined with grep to get tom's scp processes:

ps -fu tom | grep "[s]cp "

Column 6 is the tty.

share|improve this answer
+1 for the 'grep "[s]cp"' trick - it's what I use in a script I call 'procname'. – Jonathan Leffler Jun 24 '09 at 5:16

You can use tty to find out the file name of the terminal connected to standard input.

For the latter part of your question, sudo or su and then grep -c 'command' /home/username/.bash_history.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.