{"id":11497,"date":"2019-03-14T09:30:04","date_gmt":"2019-03-14T09:30:04","guid":{"rendered":"http:\/\/www.appservgrid.com\/paw92\/?p=11497"},"modified":"2019-03-14T09:30:04","modified_gmt":"2019-03-14T09:30:04","slug":"how-to-monitor-linux-commands-executed-by-system-users-in-real-time","status":"publish","type":"post","link":"https:\/\/www.appservgrid.com\/paw92\/index.php\/2019\/03\/14\/how-to-monitor-linux-commands-executed-by-system-users-in-real-time\/","title":{"rendered":"How to Monitor Linux Commands Executed by System Users in Real-time"},"content":{"rendered":"

Are you a Linux system administrator and want to monitor interactive activity of all system users (Linux commands they executes) in real-time. In this brief Linux system security guide, we will explain how to view all Linux shell commands executed by system users in real-time.<\/p>\n

Read Also<\/strong>:\u00a0How to Monitor User Activity with psacct or acct Tools<\/a><\/p>\n

If your system has\u00a0bash<\/strong>, the most commonly used shell out there then all commands executed by normal system users will be stored in the\u00a0.bash_history<\/code>\u00a0hidden file which is kept in each user\u2019s home directory. The content of this file can be viewed by users, using the\u00a0history command<\/a>.<\/p>\n

To view a user\u00a0aaronkilik\u2019s<\/strong>\u00a0.bash_history<\/code>\u00a0file, type:<\/p>\n

# cat \/home\/aaronkilik\/.bash_history\r\n<\/pre>\n
\n
\"User<\/p>\n
User bash-history file<\/p>\n
From the screen shot above, the\u00a0date<\/strong>\u00a0and\u00a0time<\/strong>\u00a0when a command was executed is not shown. This is the default setting on most if not all Linux distributions.<\/p>\n
You can follow this guide to\u00a0set date and time for each command in bash_history file<\/a>.<\/p>\n
Monitor User Activity in Real-time Using Sysdig in Linux<\/h3>\n
To get a glimpse of what users are doing on the system, you can use the\u00a0w<\/code>\u00a0command as follows.<\/p>\n
# w\r\n<\/pre>\n
\n
\"Monitor<\/p>\n
Monitor Logged in Users<\/p>\n<\/div>\n
But to have a real-time view of the shell commands being run by another user logged in via a terminal or SSH, you can use the\u00a0Sysdig tool in Linux<\/a>.<\/p>\n
Sydig<\/strong>\u00a0is an open-source, cross-platform, powerful and flexible system monitoring, analysis and troubleshooting tool for Linux. It can be used for system exploration and debugging.<\/p>\n
Once you have installed\u00a0sysdig<\/strong>, use the\u00a0spy_users<\/code>\u00a0chisel to spy on users by running the command below.<\/p>\n
# sysdig -c spy_users\r\n<\/pre>\n
The above command displays every command that users launch interactively as well as every directory users visit.<\/p>\n
\n
\"Monitor<\/p>\n
Monitor User Activity in Real-Time<\/p>\n<\/div>\n
That\u2019s all, you can also check out these following related articles:<\/p>\n
    \n
  1. 25 Hardening Security Tips for Linux Servers<\/a><\/li>\n
  2. Lynis \u2013 Security Auditing and Scanning Tool for Linux Systems<\/a><\/li>\n
  3. 10 Useful Open Source Security Firewalls for Linux Systems<\/a><\/li>\n
  4. A Practical Guide to Nmap (Network Security Scanner) in Linux<\/a><\/li>\n<\/ol>\n
    In this system security guide, we described how to view users bash history file, show logged on users and what they are doing, and we also explained how to view or monitor all commands executed by system users in real-time.<\/p>\n
    If you want to share any other methods or ask questions, please do so via the comment section below.<\/p>\n
    Source<\/a><\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"
    Are you a Linux system administrator and want to monitor interactive activity of all system users (Linux commands they executes) in real-time. In this brief Linux system security guide, we will explain how to view all Linux shell commands executed by system users in real-time. Read Also:\u00a0How to Monitor User Activity with psacct or acct … <\/p>\n
    Continue reading “How to Monitor Linux Commands Executed by System Users in Real-time”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-11497","post","type-post","status-publish","format-standard","hentry","category-linux"],"_links":{"self":[{"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/posts\/11497","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/comments?post=11497"}],"version-history":[{"count":1,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/posts\/11497\/revisions"}],"predecessor-version":[{"id":11498,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/posts\/11497\/revisions\/11498"}],"wp:attachment":[{"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/media?parent=11497"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/categories?post=11497"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/tags?post=11497"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}