LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Newbie (http://www.linuxquestions.org/questions/linux-newbie-8/)
-   -   where are all the user actions stored? (http://www.linuxquestions.org/questions/linux-newbie-8/where-are-all-the-user-actions-stored-637498/)

limit_me 04-24-2008 05:36 AM

where are all the user actions stored?
 
Hi,
I have got the following text from my friend. It was all the commands that user performed.

Apr 22 10:34:23 localhost sudo: prabin : TTY=pts/0 ;
PWD=/home/prabin ; USER=ro
ot ; COMMAND=/usr/bin/apt-get update
Apr 22 10:34:46 localhost sudo: prabin : TTY=pts/0 ;
PWD=/home/prabin ; USER=ro
ot ; COMMAND=/usr/bin/apt-get install php
Apr 22 10:34:51 localhost sudo: prabin : TTY=pts/0 ;
PWD=/home/prabin ; USER=ro
ot ; COMMAND=/usr/bin/apt-get install php5
Apr 22 10:37:48 localhost sudo: prabin : TTY=pts/0 ; PWD=/var ;
USER=root ; COM


Where is this information located?
Please reply.

Thanks in advance..

jschiwal 04-24-2008 06:08 AM

Look in /var/log/messages as root. If you use sudo, the command you enter is logged. This is one of the advantages of using sudo.

Exactly which logfile is written to is determined by your /etc/syslog-ng/syslog-ng.conf configuration file. It could filter sudo messages (sudo is the facility supplying the message) to go to a different log file.

oldscratch 04-24-2008 09:28 AM

bash history
 
If you're using bash as a shell, you can also see a user's history of bash commands in:

$HOME/.bash_history

It won't give you the date and time information that you're seeing for sudo commands in /var/log/messages, but it will show the commands the user entered.

To see the history for the user you are logged in as, use this command:

history


All times are GMT -5. The time now is 05:54 PM.