Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to monitor all user's activity in my server.

Even when the user executes a shell command from some editor like vim I want to see them in the log file.

I have checked the tool acct but it is not listing the complete commands. (Please correct me if I have missed some options which does already).

Which Linux tool I should be looking at to solve this problem?

share|improve this question
. man script(1) – adaptr Nov 30 '11 at 14:03
up vote 18 down vote accepted

Add this line to your pam config responsible for logins (its system-auth on redhat based distros)

session    required enable=*

To find out what was done, you can use.

ausearch -ts <some_timestamp> -m tty -i

This produces an output like this:

 type=TTY msg=audit(11/30/2011 15:38:39.178:12763684) : tty pid=32377 uid=root
 auid=matthew major=136 minor=2 comm=bash data=<up>,<ret>

The only downside to this is is can be a little bit difficult to read, but it is much better than most proposed solutions since in theory it could be used to record an entire session, warts n all.

Edit: Oh and you can use aureport to generate a list that can be more helpful.

# aureport --tty
12. 11/30/2011 15:50:54 12764042 501 ? 4294967295 bash "d",<^D>
13. 11/30/2011 15:52:30 12764112 501 ? 4294967295 bash "aureport --ty",<ret>
14. 11/30/2011 15:52:31 12764114 501 ? 4294967295 bash <up>,<left>,<left>,"t",<ret>
share|improve this answer
Thanks for the details. I am using Ubuntu 10.04 LTS When I check the folder /lib/security/ the module is not present but there is a man page present for that module. I think I have hit this bug Is there any other way I can install that module ? – Supratik Dec 1 '11 at 7:56
The bug report suggests a fix and update was distributed. – Matthew Ife Dec 2 '11 at 10:54
@Mlfe I compiled the PAM source code and copied the .so file in /lib/security/ and it worked. Thanks again. – Supratik Dec 4 '11 at 9:02
Note that will capture all interactions, including passwords – Cameron Kerr Sep 17 '14 at 0:09
@CameronKerr : the password issue is fixed : – Yohann Mar 3 '15 at 10:35

The best solution to your problem would be Linux' built-in audit system. Use man 8 auditd or check this page for more information:

Also, you can check this tutorial - while it is slightly out of the scope of your question, it shows how the audit system works.

share|improve this answer

here's a magic solution :

  • yum install psacct (redhat)
  • sudo apt-get install acct

you ca display statistic about user commands/connection etc..

List all commands invoked by a given user ...

Search the accounting logs by command name: $ lastcomm rm $ lastcomm passwd

and so on, for more informations please visit the above link ..

share|improve this answer

You could use snoopy.

It is a simple command logging library, and not a proper audit solution (easily circumvented). Disclosure: I am current snoopy maintainer.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.