How to see the commands executed in another shell?

Since you're root, you could always strace -f -e execve -p her_bash_pid. The -f is necessary because her shell will fork a new process before the exec, but this also means that you'll see anything that the child processes execute as well.


If your coworker can modify some history settings for their bash shell, then you can get this information from tail -f /home/user/.bash_history. Here are the setting you will need for .bash_history to be written after each command, rather than on shell exit:

export PROMPT_COMMAND="history -a"
shopt -s histappend

I would consider a screen session to be an "ideal" solution though.


After a quick research (and some thinking) I can give you the following list of possible options:

  • read her bash_history. But it is usually only written on logout. askubuntu.com has a post about changing that behaviour (edit: @jordanm apparently had the same idea and was faster to post...).
  • If she was on a physical terminal (/dev/ttyX), you could use the program conspy.
  • Make her use screen. If you just want to assist and not spy on her she might be willing to run her session inside screen. You then can simply attach to her session by sudo -u herUsername screen -x
  • You could write a shell wrapper script that logs the commands to a logfile of your choice. You'd have to set her shell to that script (This is just an idea, it might or might not work).
  • Using cat /dev/pts/X | tee /dev/pts/X was the first thing that came to my mind. But after try doesn't really work and is a very dirty solution. Every character is only printed to one of the attached terminals (which is the reason for calling tee as well). When trying it out I could spy on every second character. With a little imagination you could guess what she's up to...