On my local MACOS I setup a reverse ssh tunnel using the below command.

ssh -fnN -R 2222:localhost:22 remoteuser@remotelinuxhost

And then my MACOS is controlled by the remote linux host which fires commands using the below

ssh -p 2222 macosuser@localhost 'rm -i /tmp/ooo*.'
remove /tmp/ooootest.log? 


ssh -p 2222 macosuser@localhost 'sleep 300'

My requirement is to check on my MacOS; if there is any active command fired from linux host which is currently executing / active.

On my MacOS; I tried commands like who and w but they don't reflect the active connection running commands which are fired remotely from the Linux host.

Thus, can you please suggest how can I see the established connection for rm or sleep commands on my MacOS?

1 Answer 1


You can use an opensource cross platform tool called sysdig. This tool will show you all the commands that where executed by users, directories that were visited by users. How to install and use sysdig instructions found here

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .