Last command issued on a GNU/Linux box

Question

Someone asked at the mailing list of my local LUG if there is any way of learning the last command issued on a GNU/Linux system.

We're talking last command in a system-wide fashion I guess. After reasoning for a while if you limit the set of commands to the ones issued by actual users using an interactive console then the last one should have been registered in the command history.

Another way of thinking of this question would be asking how to tell which was the last processed that was created on a GNU/Linux box regarding if it's still running or has already finished executing, which was the parent processes and other relevant information.

Answer 1

I've fount a package for Linux that helps with process accounting.

On My Ubuntu 9.10 system I did this to install the program "acct":

sudo apt-get install acct

Then a blank log file needs to be created which you can do like this:

sudo touch /var/log/pacct

After that, process accounting needs to be activated:

sudo /usr/sbin/accton /var/log/pacct

From that point processes get logged together with the user that executed them and the asociated terminal.

The log file can be seen with this command:

lastcomm -f /var/log/pacct

I'm still looking into this program... but looks like this helps.

Answer 2

For a specific user (and shell): history

For a current process: ps

Answer 3

Well a system wide one looks quite complicated. Such a system implies that there should be some process which monitors every users .bash_history. Then when that gets updated a central db get updated. Once this is done we can may be right an extension to the "history" command which picks from the central db. Not a bad idea though.

Answer 4

IF you add the following to your /etc/sudoers file:

Defaults logfile=/var/log/sudolog

All sudo commands will be logged. This might not be every user's commands, but this should list the important ones that can modify the system, which I'd hazard a guess to say that's what you're after.

You can't simply monitor .bash_history, as other users might either not be using history, or might not be using bash to begin with.

Answer 5

You can use snoopy to monitor all commands that are executed.

Answer 6

If you want the latest running program, then using the info in /proc, something like this...

for i in $(ls -t /proc/* | egrep "[0-9]+"); do test -f $i/cmdline && cat $i/cmdline && break; done

It will look for the number based directories (the pid) in /proc, then check if the cmdline file exists and print it (Apparently the commands in the pipe disappear as soon as you get into the loop so their cmdline file cease to exist)