Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

In Unix based systems, is there a log file that stores user's executed command(s)?

share|improve this question
    
Are you asking on a per user basis or system-wide logging of user commands? –  Arcege Feb 26 '12 at 17:14
    
I want all users commands logging, i have root access to system. –  Navid Farhadi Feb 26 '12 at 17:16
    
See also Log every invocation of every SUID program? Is there a log of past threads that are now closed? You may get better answers if you say what you're after: accounting CPU time? Watching for intrusion attempts? Analyzing a break-in post mortem? … –  Gilles Feb 26 '12 at 23:40

1 Answer 1

up vote 3 down vote accepted

Given that you want to track all user commands, you should look at the acct package on your system (on some systems this is also called "process accounting" or psacct). Then after it's been turned on, you can run the lastcomm command to show what programs have been run, by whom, when and for how long. From Google, search "linux acct" for more details.

http://beginlinux.com/blog/2010/01/monitoring-user-activity-with-psacct-or-acct/

http://www.cyberciti.biz/tips/howto-log-user-activity-using-process-accounting.html

share|improve this answer
2  
Note that process accounting only logs the command name, which can be forged easily (copy or symlink the executable to the name of your choice). –  Gilles Feb 26 '12 at 23:37
    
and only logging the command name without its arguments is kind of useless. –  fduff Jun 4 at 8:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.