How to Check Commands Executed by User in Linux

Sometimes Linux system administrators to keep track of the command runs by the users on their systems. This is requires during system audits as well as investigate into suspicious user activity. There are several built-in commands to check commands run by Linux users. In this article, we will learn how to check commands executed by user in Linux.

How to Check Commands Executed by User in Linux

There are different ways to check user activity in Linux.

1. Currently Active Users

You can use w command to easily check currently active users.

$ w
04:19:21 up 24 days, 39 min,  1 user,  load average: 0.00, 0.00, 0.00
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
ubuntu   pts/0    106.214.165.131  04:19    1.00s  0.07s  0.00s w

The above command lists different users that are currently active on your system, along with idle time and system uptime.

2. Check Command History of User

Each user’s command history is stored in file /etc/<username>/.bash_history. You can easily view the command history of a user by running the following command to view that user’s file. But please note, you need to have root or sudo privileges to view other user’s command history.

$ sudo cat /etc/ubuntu/.bash_history

Alternatively, you can log into Linux as that user and run the following command to view that user’s command history.

$ sudo history

Please note, if you run the above command without logging in as other user, it will show you your own command history and not history of the other user.

3. Currently Running Processes

You can run top command to view currently running processes on your system. This command will show results for all user processes.

$ top

Alternatively, you can also run the following command to get a list of running processes. Here is a command to view all processes running for user ubuntu.

$ ps -ef | grep ubuntu

In this article, we have learnt how to check commands executed in Linux.

Also read:

How to View User Login History in Linux
How to Restrict SSH Access to Specific IP Address
How to Find User Currently Logged in Linux
How to Check Service Uptime in Linux
How to Resize Partition in Linux