Sometimes you may need to view command history for user or track user activity. You can easily do this using built-in commands in Linux. Here is how to check commands executed by user in Linux.
How to Check Commands Executed by User in Linux
Here are the different ways to check user commands in Linux.
1. Check command history of user
Every user’s command history is stored in /etc/<username>/.bash_history file. So if you want to view past commands executed by a user ubuntu just open terminal and run the following command to open that user’s .bash_history file.
$ sudo cat /etc/ubuntu/.bash_history
It is the same as logging into Linux as that user and running history command.
$ sudo history
If you run history in your account, it will only show your past commands.
If you want to clear your history of past commands just run history -c command.
$ sudo history -c
2. Currently Active Users
If you want to see currently active users on your system, you can do so with w command.
$ w 04:19:21 up 24 days, 39 min, 1 user, load average: 0.00, 0.00, 0.00 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT ubuntu pts/0 22.214.171.124 04:19 1.00s 0.07s 0.00s w
This shows a list of users with their last run command, along with other details such as idle time, and system uptime.
3. Currently Running processes
You can simply run top command to view currently running processes by all users
Or you can run ps -ef | grep <username> command to list all processes currently running due to particular user. Here is an example to view processes run by user ubuntu
$ ps -ef | grep ubuntu