Take the 2-minute tour ×

I would like to get a log of all processes that are launched with the time that they were launched and the arguments they were launched with. Is this possible in Linux?

share|improve this question
@new123456 that's exactly what I was looking for! Thanks a lot! I just tried it out and it works if I execute the command "auditctl -a task,always" after each reboot, ie. it doesn't start logging unless I execute this command, so this is perfect. –  runeks Jun 1 '11 at 19:16
@runeks All right, I've posted this as an answer so that this question can be marked answered. –  new123456 Jun 1 '11 at 20:04

4 Answers 4

up vote 25 down vote accepted

Your starting point should be auditd.

Try something like this:

apt-get install auditd
auditctl -a task,always
ausearch -i -sc execve
share|improve this answer
I'm getting error The audit system is disabled Where can I enable it? –  Tombart Jul 9 at 20:39
well one problem could be solved by chmod 0750 /sbin/audispd but it's still not working (Debian Wheezy) –  Tombart Jul 9 at 20:43
is says Unable to set audit pid, exiting but I guess that the real problem will be that the system is running in LXC container –  Tombart Jul 9 at 20:49
How does audit integrate with systemd journald? Do their functions overlap? –  CMCDragonkai Aug 15 at 11:06

You could use snoopy for this.

It is very simple to install, and since 2.x it can log arbitrary data (arguments, environmental variables, cwd, etc.).

Disclosure: Snoopy maintainer here.

share|improve this answer

I needed to do this, except (1) I didn't need the time and (2) I was only interested in processes that are started by a given process, and its children and subsequent descendants. Also, in the environment I was using, it wasn't possible to get auditd or accton, but there was valgrind.

Prefix the following to the process of interest on the command line:

valgrind --trace-children=yes

The information you need will be in the log output displayed on STDERR.

share|improve this answer

You can try cat ~/.bash_history There is system log viewer,this can help you out.

share|improve this answer
~/.bash_history only contains commands I've executed in a terminal, apparently. I'm looking for a log of all the programs executed, for example when I click an icon to open up my e-mail client, gedit, or I open up my browser, and my browser executes another process by itself. new123456's answer did the trick. –  runeks Jun 1 '11 at 19:22

Your Answer


