9

Is there a way to watch what commands are being executed in another shell, as they're being executed? Both shells are bash, and I have root access, if that matters. I can't install any extra software, and I don't want the other shell to have to do anything special like run screen.

Situation: I'm remotely logged into a Linux machine, and so is a coworker. I would like to see the commands she is running in her shell. I know that I could use some combination of watch and ps to see any commands that take longer than a second to run, but I don't believe that would help with very short commands.

  • 5
    builtin commands such as kill, and cd do not spawn sub-processes and would never appear in ps output. – jordanm Nov 8 '12 at 18:06
  • @jordanm Thanks, that's a good point. Even with just the commands that cause a fork/exec, that would probably be good enough. – Tom Panning Nov 8 '12 at 18:23
7

Since you're root, you could always strace -f -e execve -p her_bash_pid. The -f is necessary because her shell will fork a new process before the exec, but this also means that you'll see anything that the child processes execute as well.

  • Thanks, grepping strace's output for exec makes it fairly readable. I'm sure that the fact that it keeps following children of children will confuse me some day, but for now I think I'll be safe. It's a shame that there's no way to automatically detach from a process after it calls exec. – Tom Panning Nov 8 '12 at 20:11
  • It's open source; you could always add that feature if you really need it. :) Or add a slightly more intelligent script parsing the strace output that ignores a PID once it execs. – Jim Paris Nov 8 '12 at 20:28
5

If your coworker can modify some history settings for their bash shell, then you can get this information from tail -f /home/user/.bash_history. Here are the setting you will need for .bash_history to be written after each command, rather than on shell exit:

export PROMPT_COMMAND="history -a"
shopt -s histappend

I would consider a screen session to be an "ideal" solution though.

5

After a quick research (and some thinking) I can give you the following list of possible options:

  • read her bash_history. But it is usually only written on logout. askubuntu.com has a post about changing that behaviour (edit: @jordanm apparently had the same idea and was faster to post...).
  • If she was on a physical terminal (/dev/ttyX), you could use the program conspy.
  • Make her use screen. If you just want to assist and not spy on her she might be willing to run her session inside screen. You then can simply attach to her session by sudo -u herUsername screen -x
  • You could write a shell wrapper script that logs the commands to a logfile of your choice. You'd have to set her shell to that script (This is just an idea, it might or might not work).
  • Using cat /dev/pts/X | tee /dev/pts/X was the first thing that came to my mind. But after try doesn't really work and is a very dirty solution. Every character is only printed to one of the attached terminals (which is the reason for calling tee as well). When trying it out I could spy on every second character. With a little imagination you could guess what she's up to...
  • wrong: conspy does not work with ttys – Zibri Feb 21 '18 at 13:10
3

GNU screen is IMO the best commendation so far. If GNU screen (or tmux) is not available, have your coworker run script -f.

And then you can watch what she's doing by doing tail -fn +0 /path/to/typescript.

0

To share a Unix screen terminal, so you can see your coworker's inputs and output in real-time, use the Unix screen command.

  1. You and the coworker log in as the same Unix user in ssh
  2. You type in the command

    screen -d -m -S myscreenname

    screen -x myscreenname

    (Of course replace myscreenname with whatever you want the screen name to be).

  3. The coworker types the command

    screen -x myscreenname

  4. To finish with sharing your Unix terminals, either person can type in the command

    exit

The great feature of screen is that you can type in commands from your Unix terminal and the coworker can see the output on her screen. It is an excellent way to do pair-administration and mentor junior Unix admins.

0

To complete @jordanm's answer...if you are both using the same user account, i.e. the output from

echo $HOSTNAME
echo $USER 

is the same for you and your co-worker then we can have some fun.

We can enable viewing for invoked commands in one terminal to be instantly be available in another

If you invoke history in your terminal you see your previous commands. By default, bash writes its history at the end of each session to a ~/.bash_history file, overwriting the existing file with an updated version. This means that if you are logged in with multiple bash sessions, only the last one to exit will have its history saved.

-------------------------------------------------------

Edit your ~/.bashrc and add to it

export PROMPT_COMMAND="history -a; history -c; history -r; $PROMPT_COMMAND"

where

history -a appends to ~/.bash_history file immediately instead of at the end of session

history -c clears current session history

history -r reads the ~/.bash_history file that we've appended to, back into our session history

Note: the PROMPT_COMMAND parameter contains commands that are executed before each new command prompt. so command1 will only be saved to history when command2 is executed

You might also want to slap a timestamp next to each command for convenience when viewing history. Again, edit your ~/.bashrc and append

export HISTTIMEFORMAT="%d/%m/%y %T "

Also a nice hack if you like to use multiple terminals and like to have your history of commands available :)

More info

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.