How can I get the command log of a particular user on Ubuntu Server?

Question

Is there a way to find a log of all the commands that have been run by a user on Ubuntu 11.10 Server? I need to find out what my friend ran to install a program.

Answer 1

If you use something like bash as a command interpreter, you could check the history.

more /home/user/.bash_history

Answer 2

Follow these instructions (revised from this answer).

1. Modify the /etc/bash.bashrc

2. Append the below line the end of that file

    export PROMPT_COMMAND='RETRN_VAL=$?;logger -p local6.debug "$(whoami) [$$]: $(history 1 | sed "s/[ ][0-9]+[ ]//" ) [$RETRN_VAL]"'
   

3. Create a new file

   /etc/rsyslog.d/bash.conf
   

4. Add the line to the file

   local6.*    /var/log/commands.log
   

5. Add line to the file /etc/logrotate.d/rsyslog .

   Nearby:

   /var/log/mail.warn
   /var/log/mail.err
   [...]
   /var/log/message   
   

   Add this

   /var/log/commands.log
   

6. Restart the rsyslog.

   sudo service rsyslog restart