Q. How do I know which commands were run by my users on my RHEL / Debian / CentOS / Suse / Fedora Linux server?
A. You need to install package called psacct, which contains several utilities for monitoring process
activities, including ac, lastcomm, accton and sa. The ac command displays statistics about how long users have been logged on. The lastcomm command displays information about previous executed
commands. The accton command turns process accounting on or off. The sa command summarizes information about previously executed commands.
Please refer to our previous tutorial to display which commands were run on server: