Logging user or group commands like sudo on Linux

/.bashrc

if [ -n "${BASH_VERSION}" ]; then
    trap "caller >/dev/null || \
printf '%s\\n' \"\$(date '+%Y-%m-%dT%H:%M:%S%z')\
 \$(tty) \${BASH_COMMAND}\" 2>/dev/null >>~/.command_log" DEBUG
fi

or using sudo

/etc/sudoers.d/log

root         ALL=(ALL) NOPASSWD: LOG_INPUT: LOG_OUTPUT: ALL
%admingroup         ALL=(ALL) NOPASSWD: LOG_INPUT: LOG_OUTPUT: ALL

/var/log/sudo-io/