How to Check Commands Executed by User in Linux

Sometimes you may need to view command history for user or track user activity. You can easily do this using built-in commands in Linux. Here is how to check commands executed by user in Linux.

How to Check Commands Executed by User in Linux

Here are the different ways to check user commands in Linux.

1. Check command history of user

Every user’s command history is stored in /etc/<username>/.bash_history file. So if you want to view past commands executed by a user ubuntu just open terminal and run the following command to open that user’s .bash_history file.

$ sudo cat /etc/ubuntu/.bash_history

It is the same as logging into Linux as that user and running history command.

$ sudo history

If you run history in your account, it will only show your past commands.

If you want to clear your history of past commands just run history -c command.

$ sudo history -c

2. Currently Active Users

If you want to see currently active users on your system, you can do so with w command.

$ w
04:19:21 up 24 days, 39 min,  1 user,  load average: 0.00, 0.00, 0.00
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
ubuntu   pts/0    106.214.165.131  04:19    1.00s  0.07s  0.00s w

This shows a list of users with their last run command, along with other details such as idle time, and system uptime.

3. Currently Running processes

You can simply run top command to view currently running processes by all users

$ top

Or you can run ps -ef | grep <username> command to list all processes currently running due to particular user. Here is an example to view processes run by user ubuntu