Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way to watch what commands are being executed in another shell, as they're being executed? Both shells are bash, and I have root access, if that matters. I can't install any extra software, and I don't want the other shell to have to do anything special like run screen.

Situation: I'm remotely logged into a Linux machine, and so is a coworker. I would like to see the commands she is running in her shell. I know that I could use some combination of watch and ps to see any commands that take longer than a second to run, but I don't believe that would help with very short commands.

share|improve this question
builtin commands such as kill, and cd do not spawn sub-processes and would never appear in ps output. – jordanm Nov 8 '12 at 18:06
@jordanm Thanks, that's a good point. Even with just the commands that cause a fork/exec, that would probably be good enough. – Tom Panning Nov 8 '12 at 18:23
up vote 7 down vote accepted

Since you're root, you could always strace -f -e execve -p her_bash_pid. The -f is necessary because her shell will fork a new process before the exec, but this also means that you'll see anything that the child processes execute as well.

share|improve this answer
Thanks, grepping strace's output for exec makes it fairly readable. I'm sure that the fact that it keeps following children of children will confuse me some day, but for now I think I'll be safe. It's a shame that there's no way to automatically detach from a process after it calls exec. – Tom Panning Nov 8 '12 at 20:11
It's open source; you could always add that feature if you really need it. :) Or add a slightly more intelligent script parsing the strace output that ignores a PID once it execs. – Jim Paris Nov 8 '12 at 20:28

If your coworker can modify some history settings for their bash shell, then you can get this information from tail -f /home/user/.bash_history. Here are the setting you will need for .bash_history to be written after each command, rather than on shell exit:

export PROMPT_COMMAND="history -a"
shopt -s histappend

I would consider a screen session to be an "ideal" solution though.

share|improve this answer

After a quick research (and some thinking) I can give you the following list of possible options:

  • read her bash_history. But it is usually only written on logout. askubuntu.com has a post about changing that behaviour (edit: @jordanm apparently had the same idea and was faster to post...).
  • If she was on a physical terminal (/dev/ttyX), you could use the program conspy.
  • Make her use screen. If you just want to assist and not spy on her she might be willing to run her session inside screen. You then can simply attach to her session by sudo -u herUsername screen -x
  • You could write a shell wrapper script that logs the commands to a logfile of your choice. You'd have to set her shell to that script (This is just an idea, it might or might not work).
  • Using cat /dev/pts/X | tee /dev/pts/X was the first thing that came to my mind. But after try doesn't really work and is a very dirty solution. Every character is only printed to one of the attached terminals (which is the reason for calling tee as well). When trying it out I could spy on every second character. With a little imagination you could guess what she's up to...
share|improve this answer

GNU screen is IMO the best commendation so far. If GNU screen (or tmux) is not available, have your coworker run script -f.

And then you can watch what she's doing by doing tail -fn +0 /path/to/typescript.

share|improve this answer

To share a Unix screen terminal, so you can see your coworker's inputs and output in real-time, use the Unix screen command.

  1. You and the coworker log in as the same Unix user in ssh
  2. You type in the command

    screen -d -m -S myscreenname

    screen -x myscreenname

    (Of course replace myscreenname with whatever you want the screen name to be).

  3. The coworker types the command

    screen -x myscreenname

  4. To finish with sharing your Unix terminals, either person can type in the command


The great feature of screen is that you can type in commands from your Unix terminal and the coworker can see the output on her screen. It is an excellent way to do pair-administration and mentor junior Unix admins.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.