How to view command history of another user in Linux?
Become or hire the top 3% of the developers on Toptal https://topt.al/25cXVn
-------------------------------------------------------------------------------
Music by Eric Matyas
https://www.soundimage.org
Track title: Over Ancient Waters Looping
--
Chapters
00:00 Question
00:34 Accepted answer (Score 39)
01:06 Answer 2 (Score 19)
01:21 Answer 3 (Score 4)
01:36 Answer 4 (Score 3)
02:09 Thank you
--
Full question
https://superuser.com/questions/309434/h...
--
Content licensed under CC BY-SA
https://meta.stackexchange.com/help/lice...
--
Tags
#linux #administration #commandhistory
#avk47
ACCEPTED ANSWER
Score 41
On Debian-based operating systems, doing
tail /var/log/auth.log | grep username
should give you a user's sudo history. I don't believe there is a way to get a unified command history of a user's normal + sudo commands.
On RHEL-based operating systems, you would need to check /var/log/secure instead of /var/log/auth.log.
ANSWER 2
Score 18
Just tested the following, and it worked like a charm.
sudo vim /home/USER_YOU_WANT_TO_VIEW/.bash_history
ANSWER 3
Score 3
If the user issued a command as in sudo somecommand, the command will appear in the system log.
If the user spawned a shell with eg, sudo -s, sudo su, sudo sh, etc, then the command may appear in the history of the root user, that is, in /root/.bash_history or similar.
ANSWER 4
Score 1
Maybe this link has a value to you : http://www.sudo.ws/pipermail/sudo-users/2000-March/000052.html
But you should mind that leaving no trace in bash_history is just a matter of starting a command with a space etcpp. The history is a helper, not a logging-tool.
Greetings from Germany, Daniel Leschkowski