Log All Bash Commands from All Users on Ubuntu

You may want to log all commands run by a user in a shell. Even just for yourself, this can be helpful in going back to figure out what you did wrong, or what command you ran 2 months ago to get something to work.

Edit /etc/bashrc:

sudo -e /etc/bashrc

and add this line:

export PROMPT_COMMAND='RETRN_VAL=$?;logger -p local6.debug "$(whoami) [$$]: $(history 1 | sed "s/^[ ][0-9]+[ ]//" )"'

Run the following to load the changes:

source /etc/bashrc

Edit /etc/rsyslog.d/bash.conf:

sudo -e /etc/rsyslog.d/bash.conf

and add the following line:

local6.* /var/log/commands.log

Edit /etc/logrotate.d/syslog:

sudo -e /etc/logrotate.d/syslog

and add the following line:

/var/log/commands.log

Restart rsyslog service:

sudo service rsyslog restart

Now to view the logs live (such as when someone else is using the server and you want to watch them) you can use tail.

sudo tail -f /var/log/commands.log

Credit to this post on Stack Exchange – https://unix.stackexchange.com/questions/664581/how-do-i-log-all-commands-executed-by-all-users

Also credit to this post on askubuntu https://askubuntu.com/questions/93566/how-to-log-all-bash-commands-by-all-users-on-a-server/93570#93570