Q. How do I know which commands were run by my users on my RHEL / Debian / CentOS / Suse / Fedora Linux server?
A. You need to install package called psacct, which contains several utilities for monitoring process
activities, including ac, lastcomm, accton and sa. The ac command displays statistics about how long users have been logged on. The lastcomm command displays information about previous executed
commands. The accton command turns process accounting on or off. The sa command summarizes information about previously executed commands.
Please refer to our previous tutorial to display which commands were run on server:
Featured Articles:
- 20 Linux System Monitoring Tools Every SysAdmin Should Know
- 20 Linux Server Hardening Security Tips
- My 10 UNIX Command Line Mistakes
- Linux: 20 Iptables Examples For New SysAdmins
- 25 PHP Security Best Practices For Sys Admins
- The Novice Guide To Buying A Linux Laptop
- 10 Greatest Open Source Software Of 2009
- Top 5 Email Client For Linux, Mac OS X, and Windows Users
- Top 20 OpenSSH Server Best Security Practices
- Top 10 Open Source Web-Based Project Management Software
- Top 5 Linux Video Editor Software
Facebook it - Tweet it - Print it -
{ 1 comment… read it below or add one }
For those needing to log parameters of commands;
There is a package called “snoopy” it wraps “exec” calls and logs any command that has been run, it logs user, command and parameters. It does not log shell builtins like cd and ls, as they do not call exec.