Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm running Ubuntu 10.04. Is there a way I can get a daily report of who has logged onto the box, what time, and even - this may be asking too much - a report of the commands they used? This is a low-usage box and so I think this would be a nice way to see what activity is happening on it.

Along these same lines, I heard it was not possible to track when things are done on the box via non-interactive shells, such as rsync or just remotely executing single commands via ssh. Is that true, or is there a way to log and track this as well?

share|improve this question
up vote 13 down vote accepted

The information of who logged in when is available in /var/log/auth.log (or other log files on other distributions). There are multiple log monitoring programs that can extract the information you configure as relevant. On any sane system, every user authentication is logged.

To log every command invocation (but not their arguments), use process accounting, provided by the acct package Install acct on Ubuntu. If the accounting subsystem is up and running, then lastcomm shows information about finished processes.

share|improve this answer
/var/log/secure.log is another common logfile – Adrian Cornish Dec 13 '11 at 4:38
Your image is broken. – cjm Dec 13 '11 at 8:39
@cjm It's broken or not depending on which CDN host you hit, see meta.askubuntu.com/questions/1852/…. I'm still waiting for a global resolution. – Gilles Dec 14 '11 at 10:13

You can also use who or w to see who is currently logged in to the system, including SSH users.

share|improve this answer
last might be a better option for what the OP was looking for... – jasonwryan Dec 13 '11 at 6:11
indeed. "last" is the command you want. – Sirex Dec 13 '11 at 9:14
omg, that one is new to me, thanks guys! – Tim Dec 13 '11 at 13:53
This is a MUCH better answer then the selected one. – PaulBGD Jun 18 '14 at 23:17

Usually when some one logs into a user system then in /var/log/messages it gets printed as:

sshd[18468]: Accepted keyboard-interactive/pam for root from port 49867 ssh2

So just grep the messages as:

grep -E "Accepted keyboard-interactive/pam for" /var/log/messages
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.