topic user command history in Operating System - Linux

user command history

ivy1234 — Thu, 29 Jul 2010 03:50:49 GMT

In our EDP department , administrators have root password , I want to know what command that they have used , I checked /root/.bash_history and use the up arrow key to check , but only found a part of information , can advise if I want to keep all comamnd that all root user have run in the server , what can i do ? besides , if possible , if I want to have the date/time that the user run the command , what can i do ? thx

Re: user command history

Goran Koruga — Thu, 29 Jul 2010 04:06:54 GMT

Hello.

Check the man page for bash, in particular these two variables:

HISTFILESIZE
HISTTIMEFORMAT

Regards,
Goran

Re: user command history

Ron Barak — Fri, 30 Jul 2010 07:33:59 GMT

You may want to investigate a culture shift away from using "naked" root by your administrators, to using sudo.

Re: user command history

Ishwar_1 — Fri, 30 Jul 2010 18:05:58 GMT

You can configure sudo to restrict the access level.
To monitor the commands used by the root
Add this parameter in .bash_profile of user/root. You can change the HISTFILE path to your desire directory. We have chosen /root as it is home directory for root

HISTSIZE=500
HISTFILE=/root/.sh_history
export HISTSIZE HISTFILE