Find Out Which Commands Were Run on My Linux Server
Q. How do I know which commands were run by my users on my RHEL / Debian / CentOS / Suse / Fedora Linux server?
A. You need to install package called psacct, which contains several utilities for monitoring process
activities, including ac, lastcomm, accton and sa. The ac command displays statistics about how long users have been logged on. The lastcomm command displays information about previous executed
commands. The accton command turns process accounting on or off. The sa command summarizes information about previously executed commands.
Please refer to our previous tutorial to display which commands were run on server:
E-mail this to a friend
Printable version
Related Other Helpful FAQs:
- How To Search Shell Command History
- FreeBSD Find out who is logged in?
- Move or migrate user accounts from old Linux server to a new Linux server
- MySQL command to show list of databases on server
- Linux command - finding and running commands
Discussion on This FAQ
Leave a Reply
We encourage your comments, and suggestions. But please stay on topic, be polite, and avoid spam. Thank you very much for stopping by our site!
Tags: accounting, accton, audit trail, audit user command access, audit users, lastcomm, linux command auditing, psacct, security auditing, user audit, user auditing, user security
July 9th, 2008 at 6:37 pm
For those needing to log parameters of commands;
There is a package called “snoopy” it wraps “exec” calls and logs any command that has been run, it logs user, command and parameters. It does not log shell builtins like cd and ls, as they do not call exec.