Is it possible to track the terminal command of a user

Question

We want to monitor the user typing command using terminal . Where the command is saving (.bash-history) is only showing few of the command. Is it possible to get the command executed from the beginning

Check this link http://askubuntu.com/questions/160745/how-to-find-history-of-shell-commands-since-machine-was-created — BDRSuite, Dec 24 '14 at 11:08
There are several options, but I am going to guess they are somewhat off topic. You can try a key logger (probably best), pam, write a script ... http://stackoverflow.com/questions/15698590/how-to-capture-all-the-commands-typed-in-unix-linux-by-any-user and http://serverfault.com/questions/336217/how-do-i-log-every-command-executed-by-a-user and and http://www.tecmint.com/how-to-monitor-keyboard-keystrokes-using-logkeys-in-linux/ and google search ;) — Panther, Dec 24 '14 at 13:25

score 1 · Accepted Answer · answered Dec 24 '14 at 11:15

1

You can increase the bash history size. Basically you can increase it to unlimited.

export HISTSIZE=
export HISTFILESIZE=

The above lines can be added in ~/.bashrc of the user or /etc/bash.bashrc

answered Dec 24 '14 at 11:15

ztik

448

1

If a user starts their command with a space history will ignore it by default. – Rinzwind Dec 24 '14 at 11:21
is bashrc-history the only file that records the commands ? – errakeshpd Dec 24 '14 at 11:26
@errakesh this is correct. – ztik Dec 24 '14 at 11:27
Note that a user can remove commands from history if he/she wants to. See https://superuser.com/questions/525839/how-to-prevent-a-user-from-hiding-their-bash-history and https://askubuntu.com/questions/657286/how-to-prevent-commands-being-removed-from-history. – sancho.s ReinstateMonicaCellio Aug 18 '21 at 06:17

Is it possible to track the terminal command of a user

1 Answers1