8

Is there a way to find a log of all the commands that have been run by a user on Ubuntu 11.10 Server? I need to find out what my friend ran to install a program.

Knowledge Cube
  • 14,781
Goulash
  • 458

2 Answers2

10

If you use something like bash as a command interpreter, you could check the history.

more /home/user/.bash_history
Bahaïka
  • 935
  • How can i check the history with time-stamp? When each commands were used? –  Jul 02 '13 at 08:13
  • 1
    Under what conditions are commands added to the log? I've read that the commands are only added to the log when you exit. I noticed my commands weren't being added so I thought maybe it was because I was being kicked rather than exiting. Then I tried existing and even the they weren't added. I ask because I'm only seeing a few commands from early on in my new Ubuntu installation. – mikato Jul 16 '14 at 17:38
-2

Follow these instructions (revised from this answer).

  1. Modify the /etc/bash.bashrc

  2. Append the below line the end of that file

     export PROMPT_COMMAND='RETRN_VAL=$?;logger -p local6.debug "$(whoami) [$$]: $(history 1 | sed "s/[ ][0-9]+[ ]//" ) [$RETRN_VAL]"'

  3. Create a new file

    /etc/rsyslog.d/bash.conf

  4. Add the line to the file 

    local6.*    /var/log/commands.log

  5. Add line to the file /etc/logrotate.d/rsyslog .

    Nearby: 

    /var/log/mail.warn
/var/log/mail.err
[...]
/var/log/message

    Add this

    /var/log/commands.log

  6. Restart the rsyslog.

    sudo service rsyslog restart
karel
  • 114,770
jawad846
  • 101
  • 3
  • 1
    This seems to be a bad copy of https://unix.stackexchange.com/a/207819/130000, and this is not an answer to the question about command already issued – pim Apr 20 '18 at 12:10