How to Monitor Linux Commands Executed by System Users in Real-time
Quelle: https://www.tecmint.com/monitor-linux-commands-executed-by-system-users-in-real-time/
Read Also: How to Monitor User Activity with psacct or acct Tools
If your system has bash, the most commonly used shell out there then all commands executed by normal system users will be stored in the .bash_history hidden file which is kept in each user’s home directory. The content of this file can be viewed by users, using the history command.
To view a user aaronkilik’s .bash_history file, type:
# cat /home/aaronkilik/.bash_history
User bash-history file
From the screen shot above, the date and time when a command was executed is not shown. This is the default setting on most if not all Linux distributions.
You can follow this guide to set date and time for each command in bash_history file.
Monitor User Activity in Real-time Using Sysdig in Linux
To get a glimpse of what users are doing on the system, you can use the w command as follows.
# w
Monitor Logged in Users
But to have a real-time view of the shell commands being run by another user logged in via a terminal or SSH, you can use the Sysdig tool in Linux.
Sydig is an open-source, cross-platform, powerful and flexible system monitoring, analysis and troubleshooting tool for Linux. It can be used for system exploration and debugging.
Once you have installed sysdig, use the spy_users chisel to spy on users by running the command below.
# sysdig -c spy_usersThe above command displays every command that users launch interactively as well as every directory users visit.
Monitor User Activity in Real-Time
That’s all, you can also check out these following related articles:
In this system security guide, we described how to view users bash history file, show logged on users and what they are doing, and we also explained how to view or monitor all commands executed by system users in real-time.
No Comments