Home / ubuntu / Questions / 183524
Accepted
KK Patel
Asked: 2012-09-04 01:28:22 +0800 CST

Log user activity for the last 24 hours by terminal

  • 772

How can I log the activity of users for the last 24 hours by terminal in a system? Which command will give me this information?

command-line

3 Answers

  1. Best Answer
    • ~/.bash_history will show the commands that was used by a user.
    • Install acct : sudo apt-get install acct in addition to login/logout. It provides logs of every single command run by every single user. Below mentioned commands are the features of acct
      • ac print statistics about connect time
      • accton turns accounting on or off
      • last list last logins of users and terms
      • lastcomm list last commands executed
      • sa print accounting statistics
      • dump-acct print accounting file in human-readable form
    • 9

  2. The "last" command is designed to give you this information.

    Example:

    laptop:~% last
userx pts/0        :0.0             Mon Sep  3 11:31   still logged in   
userx pts/0        :0.0             Mon Sep  3 11:30 - 11:30  (00:00)    
userx pts/0        :0.0             Mon Sep  3 11:30 - 11:30  (00:00)    
userx pts/4        :0.0             Mon Sep  3 11:25   still logged in   
userx pts/2        :0.0             Mon Sep  3 11:23 - 11:28  (00:05)    
userx pts/2        :0.0             Mon Sep  3 11:20 - 11:20  (00:00)    
root  pts/1        :0.0             Mon Sep  3 11:19 - 11:28  (00:09)    
root  pts/1        :0.0             Mon Sep  3 11:19 - 11:19  (00:00)    
userx pts/0        :0.0             Mon Sep  3 11:10 - 11:12  (00:01)    
root  pts/1        :0.0             Mon Sep  3 11:05 - 11:10  (00:04)    
userx pts/3        :0.0             Mon Sep  3 10:18   still logged in   

wtmp begins Mon Sep  3 10:18:35 2012

    However as far as I know, there is no option to restrict the lookup to the last 24 hours.

    • 7
    1. who

    The who command Shows who is currently logged in to the system and information such as the time of the last login. You can use options such as -H (display column headings) -r (current runlevel) -a (display information provided by most options).

    1. w

    The ‘w‘ command Displays information about the users currently on the machine and their processes. The first line includes information on the current time, how long the system has been running, how many users are currently logged on, and the system load averages for the past 1, 5, and 15 minutes.

    1. last

    The last command displays a list of users who logged in and out since the /var/log/wtmp file was created. The last command searches back through the /var/log/wtmp file (or the file designated by the -f option) and displays a list of all users who have logged in (and out) since the file was created. You can specify names of users and TTY’s to show only information for those entries.

    1. lastlog

    The lastlog command formats and prints the contents of the last login log file (/var/log/lastlog). The login name, port, and last login time are displayed.

    Entering the command without options displays the entries sorted by numerical ID. You can use options such as -u login_name (display information for designated user only) and -h (display a one-line help message). If a user has never logged in, the message Never logged in is displayed in place of the port and time. For example, entering lastlog returns information similar to the following:

    • 0