Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to get a log of all processes that are launched with the time that they were launched and the arguments they were launched with. Is this possible in Linux?

share|improve this question
    
@new123456 that's exactly what I was looking for! Thanks a lot! I just tried it out and it works if I execute the command "auditctl -a task,always" after each reboot, ie. it doesn't start logging unless I execute this command, so this is perfect. – runeks Jun 1 '11 at 19:16
1  
@runeks All right, I've posted this as an answer so that this question can be marked answered. – new123456 Jun 1 '11 at 20:04
up vote 29 down vote accepted

Your starting point should be auditd.

Try something like this:

apt-get install auditd
auditctl -a task,always
ausearch -i -sc execve
share|improve this answer
    
I'm getting error The audit system is disabled Where can I enable it? – Tombart Jul 9 '14 at 20:39
    
well one problem could be solved by chmod 0750 /sbin/audispd but it's still not working (Debian Wheezy) – Tombart Jul 9 '14 at 20:43
    
is says Unable to set audit pid, exiting but I guess that the real problem will be that the system is running in LXC container – Tombart Jul 9 '14 at 20:49
    
How does audit integrate with systemd journald? Do their functions overlap? – CMCDragonkai Aug 15 '14 at 11:06

I needed to do this, except (1) I didn't need the time and (2) I was only interested in processes that are started by a given process, and its children and subsequent descendants. Also, in the environment I was using, it wasn't possible to get auditd or accton, but there was valgrind.

Prefix the following to the process of interest on the command line:

valgrind --trace-children=yes

The information you need will be in the log output displayed on STDERR.

share|improve this answer

You could use snoopy for this.

It is very simple to install, and since 2.x it can log arbitrary data (arguments, environmental variables, cwd, etc.).

Disclosure: Snoopy maintainer here.

share|improve this answer

You can try cat ~/.bash_history There is system log viewer,this can help you out.

share|improve this answer
1  
~/.bash_history only contains commands I've executed in a terminal, apparently. I'm looking for a log of all the programs executed, for example when I click an icon to open up my e-mail client, gedit, or I open up my browser, and my browser executes another process by itself. new123456's answer did the trick. – runeks Jun 1 '11 at 19:22
    
Let's also add that the command history is the usual way of accessing this information. – bryn Apr 28 at 9:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .