Log user activity for the last 24 hours by terminal
Solution 1:
-
~/.bash_history
will show the commands that was used by a user. - Install acct :
sudo apt-get install acct
in addition to login/logout. It provides logs of every single command run by every single user. Below mentioned commands are the features of acct-
ac
print statistics about connect time -
accton
turns accounting on or off -
last
list last logins of users and terms -
lastcomm
list last commands executed -
sa
print accounting statistics -
dump-acct
print accounting file in human-readable form
-
Solution 2:
The "last" command is designed to give you this information.
Example:
laptop:~% last
userx pts/0 :0.0 Mon Sep 3 11:31 still logged in
userx pts/0 :0.0 Mon Sep 3 11:30 - 11:30 (00:00)
userx pts/0 :0.0 Mon Sep 3 11:30 - 11:30 (00:00)
userx pts/4 :0.0 Mon Sep 3 11:25 still logged in
userx pts/2 :0.0 Mon Sep 3 11:23 - 11:28 (00:05)
userx pts/2 :0.0 Mon Sep 3 11:20 - 11:20 (00:00)
root pts/1 :0.0 Mon Sep 3 11:19 - 11:28 (00:09)
root pts/1 :0.0 Mon Sep 3 11:19 - 11:19 (00:00)
userx pts/0 :0.0 Mon Sep 3 11:10 - 11:12 (00:01)
root pts/1 :0.0 Mon Sep 3 11:05 - 11:10 (00:04)
userx pts/3 :0.0 Mon Sep 3 10:18 still logged in
wtmp begins Mon Sep 3 10:18:35 2012
However as far as I know, there is no option to restrict the lookup to the last 24 hours.