Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I would like to get a log of all processes that are launched with the time that they were launched and the arguments they were launched with. Is this possible in Linux?

share|improve this question
    
@new123456 that's exactly what I was looking for! Thanks a lot! I just tried it out and it works if I execute the command "auditctl -a task,always" after each reboot, ie. it doesn't start logging unless I execute this command, so this is perfect. –  runeks Jun 1 '11 at 19:16
1  
@runeks All right, I've posted this as an answer so that this question can be marked answered. –  new123456 Jun 1 '11 at 20:04

4 Answers 4

up vote 25 down vote accepted

Your starting point should be auditd.

Try something like this:

apt-get install auditd
auditctl -a task,always
ausearch -i -sc execve
share|improve this answer
    
I'm getting error The audit system is disabled Where can I enable it? –  Tombart Jul 9 at 20:39
    
well one problem could be solved by chmod 0750 /sbin/audispd but it's still not working (Debian Wheezy) –  Tombart Jul 9 at 20:43
    
is says Unable to set audit pid, exiting but I guess that the real problem will be that the system is running in LXC container –  Tombart Jul 9 at 20:49
    
How does audit integrate with systemd journald? Do their functions overlap? –  CMCDragonkai Aug 15 at 11:06

You could use snoopy for this.

It is very simple to install, and since 2.x it can log arbitrary data (arguments, environmental variables, cwd, etc.).

Disclosure: Snoopy maintainer here.

share|improve this answer

I needed to do this, except (1) I didn't need the time and (2) I was only interested in processes that are started by a given process, and its children and subsequent descendants. Also, in the environment I was using, it wasn't possible to get auditd or accton, but there was valgrind.

Prefix the following to the process of interest on the command line:

valgrind --trace-children=yes

The information you need will be in the log output displayed on STDERR.

share|improve this answer

You can try cat ~/.bash_history There is system log viewer,this can help you out.

share|improve this answer
1  
~/.bash_history only contains commands I've executed in a terminal, apparently. I'm looking for a log of all the programs executed, for example when I click an icon to open up my e-mail client, gedit, or I open up my browser, and my browser executes another process by itself. new123456's answer did the trick. –  runeks Jun 1 '11 at 19:22

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.