Comments on: How to Monitor Linux User Activity with psacct and acct Tools

By: Aasifa

Aasifa — Tue, 04 Aug 2020 12:32:34 +0000

In reply to Ashish. Hi, When I executed lastcomm sdiff command, I could output is popping multiple times instead of a single display, please help me on this?

[root@qns01 ~]# lastcomm sdiff
sdiff                   root     pts/0      0.00 secs Mon Aug  3 07:52
sdiff                   root     pts/0      0.00 secs Mon Aug  3 07:52
sdiff                   root     pts/0      0.00 secs Mon Aug  3 07:52
sdiff                   root     pts/0      0.00 secs Mon Aug  3 07:52
sdiff                   root     pts/0      0.00 secs Mon Aug  3 07:52

By: Ashish

Ashish — Mon, 17 Sep 2018 07:36:05 +0000

I am very new to linux administration. To audit user activity, I installed and used psacct with the following command:

# lastcomm root

but I do not get any mention for the command "history" that I ran to test. Is there something I am doing wrong?

By: sush

sush — Wed, 26 Jul 2017 12:26:52 +0000

In reply to sush.

Hi,

I think you didn’t got my question. Can I repeat?

By: sush

sush — Mon, 24 Jul 2017 07:35:04 +0000

In reply to Ravi Saive.

Hello Ravi,

Thanks for your reply. but here we have only 2 users first login into admin after switch user to root. All our operations team members are working in root administrator account. So in that case I want to found in root only which member have executed the commands in root bash_history.

By: Ravi Saive

Ravi Saive — Mon, 24 Jul 2017 06:31:01 +0000

In reply to sush.

@Sush,

You can find all users commands history under /home/user_name/.bash_history file, you can use find or grep command to list the history of all users..