# Monitor GCE VM commands
**URL:** https://discuss.elastic.co/t/monitor-gce-vm-commands/286988
**Category:** Beats
**Tags:** beats-module, auditbeat
**Created:** [October 18, 2021, 11:56am UTC](https://discuss.elastic.co/t/monitor-gce-vm-commands/286988 "2021-10-18T11:56:36Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@\_bugc4t](https://discuss.elastic.co/u/_bugc4t)
#### Post date: [October 18, 2021, 11:56am UTC](https://discuss.elastic.co/t/monitor-gce-vm-commands/286988/1 "2021-10-18T11:56:36Z")
I've got a running filebeat ECK cluster. However, I've got a new requirement to incorporate VM commands and processes from another GCP project for analysis.
I've looked into the GCP Ops Agent and Auditbeat but neither seem to be advertising command logging.
I've already got Put/Sub integration. Is there a way to get the VM commands logged and output to Pub/Sub?
Is there a solution I can look into that already does this in a similar manner to my filebeat deployment?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 15, 2021, 1:56pm UTC](https://discuss.elastic.co/t/monitor-gce-vm-commands/286988/2 "2021-11-15T13:56:39Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
---
### Author:  [@Edoardo\_Tenani](https://discuss.elastic.co/u/Edoardo_Tenani)
#### Post date: [December 3, 2021, 9:23am UTC](https://discuss.elastic.co/t/monitor-gce-vm-commands/286988/3 "2021-12-03T09:23:22Z")
---
### Author:  [@Edoardo\_Tenani](https://discuss.elastic.co/u/Edoardo_Tenani)
#### Post date: [December 3, 2021, 9:27am UTC](https://discuss.elastic.co/t/monitor-gce-vm-commands/286988/4 "2021-12-03T09:27:31Z")
Hello @_bugc4t, sorry for the late reply. I checked internally and it is possible to monitor shell activity through Osquery, in particular with the `shell_history` table. Filebeat has an `osquery` [module](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-osquery.html) that would allow to collect log results.
Using a query like `select * from users join shell_history using (uid)`) would retrieve a history of commands run per user.
Would this fulfil your use case?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 4, 2022, 8:32am UTC](https://discuss.elastic.co/t/monitor-gce-vm-commands/286988/5 "2022-11-04T08:32:43Z")