Introduction
Command logging can be useful when you need to track commands executed by users on a Linux server. It can help administrators review user activity and investigate unexpected or abnormal actions performed on the system.
This guide explains how to enable command logging using Bash and rsyslog, and store the logged commands in a separate log file.
Prerequisites
Before configuring command logging, make sure you have:
- Root or
sudoaccess to the Linux server. - Bash shell access.
rsysloginstalled and running.- Basic knowledge of Linux configuration files and services.
Implementation
Step 1: Configure Bash Command Logging
For CentOS/RHEL-based systems, edit:
/etc/bashrc
Add the following line:
export PROMPT_COMMAND='RETRN_VAL=$?;logger -p local6.debug "$(whoami) [$$]: $(history 1 | sed "s/^[ ]*[0-9]\+[ ]*//" ) [$RETRN_VAL]"'
This configures Bash to send the executed command information to the system logger.
For Ubuntu Server, the Bash configuration file is
/etc/bash.bashrc
Add the same PROMPT_COMMAND line to this file.
Step 2: Configure the Syslog Format
Add the following configuration to the syslog configuration file:
local6.* /var/log/cmdlog.log
This tells the logging service to store messages received through the local6 facility in:
/var/log/cmdlog.log
Step 3: Restart rsyslog
Restart the rsyslog service to apply the configuration.
For CentOS/RHEL:
/etc/init.d/rsyslog restart
For Ubuntu Server:
service rsyslog restart
Step 4: Verify Command Logging
After opening a new shell session, execute a test command:
whoami
Then check the command log:
cat /var/log/cmdlog.log
The executed command should be recorded in the log file along with information such as the username, process ID, and command return value.
Conclusion
Enabling Bash command logging provides administrators with an additional way to track activity on Linux hosts. By using PROMPT_COMMAND with logger and configuring rsyslog, executed commands can be stored separately in /var/log/cmdlog.log.
This can be useful for troubleshooting, auditing, and investigating unexpected activity on Linux servers.
Security Note: Command logging should be implemented with appropriate access controls because command logs may contain sensitive information. Bash history and this logging method are not a complete security audit solution.
FAQs
1. Where are command logs stored?
With the configuration in this guide, command logs are stored in:
/var/log/cmdlog.log
2. Which file should be modified on Ubuntu?
On Ubuntu Server, use:
/etc/bash.bashrc
On CentOS/RHEL-based systems, use:
/etc/bashrc
3. Why is rsyslog restarted after making the configuration change?
Restarting rsyslog ensures that the new local6 logging configuration is loaded and applied.
4. Can command logging help identify abnormal user activity?
Yes. The logs can help administrators review commands executed during user sessions and investigate unexpected activity.
Related Articles
- Atop Installation on Linux Host – Learn how to install and use Atop for monitoring Linux system and process activity.
Read the article - Install Multiple Versions of Node.js on Linux – Learn how to install and manage multiple Node.js versions on a Linux server.
Read the article
Talk to our experts
Looking for the right technology solution for your business? Our team of experts can help you with development, cloud, DevOps, design, and a wide range of other technology needs. Get in touch with our team here.