Skip to content

How to Log All Commands On Linux?

log all commands on linux

The previous article explained displaying all Linux commands using the history command. But sometimes I have trouble if the root user comes from another Linux user so I am confused about troubleshooting which user is running the Linux command which may be dangerous for the server.

 

Problem

How to log all commands in Linux?

 

Solution

Here are ways to log all commands in Linux and it works on OpenSUSE, Ubuntu/Debian, and RedHat-Based distro:

1. Changing the bashrc file

Modify the /etc/bashrc file by adding the following script to it:

export PROMPT_COMMAND='RETRN_VAL=$?;logger -p local6.debug "$(whoami) [$$]: $(history 1 | sed "s/^[ ]*[0-9]\+[ ]*//" )"'

 

After that do the command below:

source /etc/bashrc

 

2. Change the bash.conf file

Modify /etc/rsyslog.d/bash.conf file by adding the following script to it:

local6.*    /var/log/commands.log

 

3. Changing the syslog file

Modify the /etc/logrotate.d/syslog file by adding the following script to it:

/var/log/commands.log

 

4. Restart the rsyslog service

Then restart the rsyslog service using the command:

systemctl restart rsyslog

 

After that, try to do the test by logging in as an ordinary Linux user and doing Linux commands. Then change the user to the root user and perform Linux commands it should all commands executed will be recorded in the /var/log/commands.log file as shown below:

Display all Linux commands

 

Note

Since the /var/log/commands.log file stores all the commands executed by the user, you must pay attention to the size of the file because the file size can be very large.

 

Reference

askubuntu.com
unix.stackexchange.com

 

Print Friendly, PDF & Email
Tags:

Leave a Reply

Your email address will not be published. Required fields are marked *