Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there any way to listen in on port 22, on my server, to see if anyone submitted any commands while ssh'd into my server? Or rather, output what commands were submitted (and the ip address of who connected), almost like a 'live' log?

share|improve this question

migrated from Apr 29 '11 at 0:00

This question came from our site for professional and enthusiast programmers.

strace -o trace -f -p PID_OF_SSH # will give lots of output and very low level 
share|improve this answer
This must be run as root or the user who owns the SSH process on Linux. – user314104 Mar 11 '13 at 2:05

The auth.log file should have a history of SSH logins (enabled by default).

If you're running SSH on port 22 you should have extreme password requirements or use SSH Keys and disable password authentication.

share|improve this answer

Unlikely. If you have ssh running on port 22 (as it's intended), then the communications are encrypted.

w or who or last will let you see who is connected.

If they're logging their commands to a history, then you could inspect their history files.

Also, this should be on Super User.

share|improve this answer
So I couldn't see who is connected and what commands they are submitting? On my server? – mcwillig Apr 28 '11 at 23:54
Ah, my mistake, but my question still stands – mcwillig Apr 28 '11 at 23:55
Not by listening on port 22, no. – Andy Lester Apr 28 '11 at 23:55
You can see who's connected. See: w or who or last. If they're logging their commands to a history, then you could inspect their history files. – entropo Apr 28 '11 at 23:56
You say not by listening, so is there another way of doing this? – mcwillig Apr 28 '11 at 23:57

You can use process accounting to keep a detailed log of commands run on your server.

On Debian:

apt-get install acct

Then use lastcomm to see who ran what at what time. lastcomm --help lists several ways to get information, including filtering by user, command or tty.

You can use last to figure out which virtual terminal (for example pts/9) was assigned to the ssh session you're interested in. Then, continuing with the example, run:

lastcomm pts/9
share|improve this answer

Turn up the logging on your SSH daemon.

         Gives the verbosity level that is used when logging messages from
         sshd.  The possible values are: QUIET, FATAL, ERROR, INFO, VER-
         BOSE, DEBUG, DEBUG1, DEBUG2 and DEBUG3.  The default is INFO.
         DEBUG and DEBUG1 are equivalent.  DEBUG2 and DEBUG3 each specify
         higher levels of debugging output.  Logging with a DEBUG level
         violates the privacy of users and is not recommended.
share|improve this answer
Actually, logging with DEBUG and higher levels outputs quite a bit of information but I haven't ever seen it logging the commands run. Are you sure about this? – Eduardo Ivanec Apr 29 '11 at 5:17

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.