4

In Unix based systems, is there a log file that stores user's executed command(s)?

3

Given that you want to track all user commands, you should look at the acct package on your system (on some systems this is also called "process accounting" or psacct). Then after it's been turned on, you can run the lastcomm command to show what programs have been run, by whom, when and for how long. From Google, search "linux acct" for more details.

http://beginlinux.com/blog/2010/01/monitoring-user-activity-with-psacct-or-acct/

http://www.cyberciti.biz/tips/howto-log-user-activity-using-process-accounting.html

  • 2
    Note that process accounting only logs the command name, which can be forged easily (copy or symlink the executable to the name of your choice). – Gilles 'SO- stop being evil' Feb 26 '12 at 23:37
  • and only logging the command name without its arguments is kind of useless. – fduff Jun 4 '14 at 8:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.