I like the BASH Shell – it’s fun and the default shell, so pretty much everyone can use it. And since I like the Ubuntu/Debian, the following steps apply to these systems – and you can probably figure out how to get them to work with BSD or another *nix flavor.
Finding out what people do with their access, on the other hand, is a little more difficult.
Sure, you can lookup their bash_history file, but that only goes back 15 to 25 commands (unless setup to a non-standard logging).
nano /home/username/.bash_history
Then I was turned onto Accounting Management:
apt-get install acct
That’s it! Easy, right?
Well, to see the information you have to know which commands to type.
LastComm shows the last command by a certain user, or when the command last matches your variable:
lastcomm username
lastcomm PID/Process
AC
ac
ac -d
ac -p