How to configure Linux to journal all command entered by a user after they use sudo su - or sudo su - username ?

1 Answer 1


By default systemd-journald logs all events that are happening in the system into a single centralized database in /run/log.

You can filter out the log entries made by the user by using "_UID" field.

ex: journalctl _UID=1000 _COMM=su This will show all the logs associated with the user id 1000.

The journals in the /run/log are non-persistent(cleared off at reboot). For persistence you need to modify the journald.conf file.

Go to /etc/systemd/journald.conf and uncomment the following line.


Then create a "journal" dir in /var/log and reload systemd-journald. sudo killall -USR1 systemd-journald.

  • This answer misses the point of the question: to log all commands run in a sudo session
    – muru
    Apr 11, 2018 at 14:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .