Copy of $HOME/.sh_history file

[Scott Ransted_1]

I'm trying to create a 2nd copy of users $HOME/.sh_history files. Can something like tee be used? The request I have is actually to save a copy of each users history file that is not accessable by the user, but as far as I can tell, that can't be done.

Any thoughts on how to do this?

[Michael Schulte zur Sur · Accepted solution]

HI,

what about
nohup tail -f $HOME/.sh_history > /path/user.history 2>&1
?
For each user one proces and the log can not be accessed.

greetings,

Michael

[Victor Fridyev]

Hi,

I beleive that you have a good reason to have a copy of thes files, especially taking into account that there is a limitation (HISTFILE) for a number of command in the file, so in any case you can loose some data.
In any case you can create a hard link for each .sh_history as following:

ln /home/username/.sh_history /home/history/username


HTH

[Michael Schulte zur Sur]

Hi Victor,

a hard linked file has the same inode and contains the same data which means you will have nothing gained execpt more security against loss.

greetings,

Michael

[Victor Fridyev]

Michael,
You are 100% right. I can't understand the reason for having copies of these files, but you can do a daily backup of one directory with all these files and investigate them (or restore) if needed.

Best Regards.

[Bill Hassell]

If the reson you need a copy of the shell history is to track problem users, the hard link will not protect from a user zeroing the file (a common technique to cover one's tracks). You'll need to get a snapshot of the file every minute. tail -f might work although it may expect to be part of an interactive session. Otherwise, just echo the current date and then tail -50 .sh_history into a logfile.