Command logging can be useful when you need to track commands executed by users on a Linux server. It can help administrators review user activity and investigate unexpected or abnormal actions performed on the system.<\/p>\n\n\n\n
This guide explains how to enable command logging using Bash and Before configuring command logging, make sure you have:<\/p>\n\n\n\n For CentOS\/RHEL-based systems, edit:<\/p>\n\n\n\n Add the following line:<\/p>\n\n\n\n This configures Bash to send the executed command information to the system logger.<\/p>\n\n\n\n For Ubuntu Server, the Bash configuration file is<\/p>\n\n\n\n Add the same Add the following configuration to the syslog configuration file:<\/p>\n\n\n\n This tells the logging service to store messages received through the Restart the For CentOS\/RHEL:<\/p>\n\n\n\n For Ubuntu Server:<\/p>\n\n\n\n After opening a new shell session, execute a test command:<\/p>\n\n\n\n Then check the command log:<\/p>\n\n\n\n The executed command should be recorded in the log file along with information such as the username, process ID, and command return value.<\/p>\n\n\n\n Enabling Bash command logging provides administrators with an additional way to track activity on Linux hosts. By using This can be useful for troubleshooting, auditing, and investigating unexpected activity on Linux servers.<\/p>\n\n\n\n Security Note:<\/strong> Command logging should be implemented with appropriate access controls because command logs may contain sensitive information. Bash history and this logging method are not a complete security audit solution.<\/p>\n<\/blockquote>\n\n\n\n With the configuration in this guide, command logs are stored in:<\/p>\n\n\n\n On Ubuntu Server, use:<\/p>\n\n\n\n On CentOS\/RHEL-based systems, use:<\/p>\n\n\n\n Restarting Yes. The logs can help administrators review commands executed during user sessions and investigate unexpected activity.<\/p>\n\n\n\nrsyslog<\/code>, and store the logged commands in a separate log file.<\/p>\n\n\n\nPrerequisites<\/h2>\n\n\n\n
\n
sudo<\/code> access to the Linux server.<\/li>\n\n\n\nrsyslog<\/code> installed and running.<\/li>\n\n\n\nImplementation<\/h2>\n\n\n\n
Step 1: Configure Bash Command Logging<\/h3>\n\n\n\n
\/etc\/bashrc<\/pre>\n\n\n\n
export PROMPT_COMMAND='RETRN_VAL=$?;logger -p local6.debug \"$(whoami) [$$]: $(history 1 | sed \"s\/^[ ]*[0-9]\\+[ ]*\/\/\" ) [$RETRN_VAL]\"'<\/pre>\n\n\n\n
\/etc\/bash.bashrc<\/pre>\n\n\n\n
PROMPT_COMMAND<\/code> line to this file.<\/p>\n\n\n\nStep 2: Configure the Syslog Format<\/h3>\n\n\n\n
local6.* \/var\/log\/cmdlog.log<\/pre>\n\n\n\n
local6<\/code> facility in:<\/p>\n\n\n\n\/var\/log\/cmdlog.log<\/pre>\n\n\n\n
Step 3: Restart rsyslog<\/h3>\n\n\n\n
rsyslog<\/code> service to apply the configuration.<\/p>\n\n\n\n\/etc\/init.d\/rsyslog restart<\/pre>\n\n\n\n
service rsyslog restart<\/pre>\n\n\n\n
Step 4: Verify Command Logging<\/h3>\n\n\n\n
whoami<\/pre>\n\n\n\n
cat \/var\/log\/cmdlog.log<\/pre>\n\n\n\n
Conclusion<\/h2>\n\n\n\n
PROMPT_COMMAND<\/code> with logger<\/code> and configuring rsyslog<\/code>, executed commands can be stored separately in \/var\/log\/cmdlog.log<\/code>.<\/p>\n\n\n\n\n
FAQs<\/h2>\n\n\n\n
1. Where are command logs stored?<\/h3>\n\n\n\n
\/var\/log\/cmdlog.log<\/pre>\n\n\n\n
2. Which file should be modified on Ubuntu?<\/h3>\n\n\n\n
\/etc\/bash.bashrc<\/pre>\n\n\n\n
\/etc\/bashrc<\/pre>\n\n\n\n
3. Why is rsyslog restarted after making the configuration change?<\/h3>\n\n\n\n
rsyslog<\/code> ensures that the new local6<\/code> logging configuration is loaded and applied.<\/p>\n\n\n\n4. Can command logging help identify abnormal user activity?<\/h3>\n\n\n\n
Related Articles<\/h2>\n\n\n\n
\n
Read the article<\/a><\/li>\n\n\n\n
Read the article<\/a><\/li>\n<\/ul>\n\n\n\nTalk to our experts<\/h2>\n\n\n\n