Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a closed source program which calls server over SSH and executes a set of commands.

Could you tell me how can I log all commands?

My server is under Ubuntu.

share|improve this question
maybe this can help you… – c4f4t0r Dec 26 '13 at 20:34… a more detailed answer explaining how to use auditd – fuero Dec 26 '13 at 22:43

Snoopy can be used to log all commands ran on a system. Logs will be sent to syslog.

share|improve this answer

Without knowing exactly how it's doing it's thing, there's no one answer that I can give. However, a few possibilities:

  • It uses keys for authentication, and runs a command it passes at login: This is easy. Add a command= to the entry in ~/.ssh/authorized_keys that calls a script that logs the command it runs, and then just execs the command. Transparent, simple.
  • It uses keys for authentication, runs a shell, and stuffs commands down the shell: Harder, but still straightforward. Again, command= in ~/.ssh/authorized_keys to run a shell of your choosing, which could be something like sudoshell or something else that logs all commands (for super bonus trickery, you could even use script for full replayability).
  • It uses passwords: No command= trickery allowed here, you're going to have to go the whole hog and use something like snoopy to log everything that happens -- but unless this program is the only thing using SSH, you'll likely end up with a lot of logs.
share|improve this answer
the program can use key based auth. do you have script sample to log calls? thank you – user349302 Jul 5 '11 at 0:11

If the close source program allows you to edit remote SSH parameters or you can put the commands into a shell script, you can wrap your execution around the "script" command on the remote server like this:

ssh 'script ps.log -c "ps -ef"'

In this case, the output of ps -ef is saved into the file ps.log

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.