How retrive the commands list issued one week ago

[Singaram]

In other words what file does the history command works on. Is there any way to retrive that last one month commands issued by a user.

Thanks
Singaram

[Steven E. Protter]

Posix:

/home_directory/.sh_history

For this data to be collected, two variables must be set in the user environment.

HISTFILE=$HOME/.sh_history
HISTSIZE=5000

The actual value in the HISTFILE variable will tell you where the command log is.

SEP

[Karthik S S]

You can get the list of commands from $HOME/.sh_history. But it is not possible to filter the list of commands based on a tome frame.

-Karthik S S

[RAC_1]

$HOME/.sh_histoty is the file.

If this has been set in /etc/profile or .profile of the user

[Michael Tully]

Unless you have auditing turned on forget it. The $HOME/.sh_history file will record commands etc, but no time of attempt will be recorded. Even this may not work depending on the shell being utilised by the user.

[Geoff Wild]

Here's what we do in root's profile:

# Set up logging
HISTFILE=${HOME}/.sh_history_`who am i|awk '{ print $1}'`
date >>$HISTFILE
export HISTFILE
HISTSIZE=500
export HISTSIZE

That creates a seperate .sh_history for each root user. It time stamps each time they log in...

To go back a month - that would requre using something like cron to echo the date to everyone's .sh_history say at midnight every night - then you would be able to see the commands users used each day....

Rgds...Geoff

[Singaram]

This history file will initialize every time it reaches the max size or continue to store the last 500 commands?

Thanks
Singaram

[Patrick Wallek]

The history file is a FIFO (first in first out) file. So it will keep the last 500, or whatever you set that value to, commands issued.

[Michael Schulte zur Sur]

Hi,

try this

greetings,

Michael

DATE=`date "+%b_%Y"`
if [ ! -f ${HOME}/.shistory_${DATE}.* ]
then
VERSION=1;
else
HISTFILE=`ls $HOME/.shistory_${DATE}.*|tail -1`
VERSION=`expr "${HISTFILE}" : ".*_.........\(.*\)$"`
LCOUNT=`cat ${HISTFILE} | wc -l | awk '{print $1}'`
if [ ${LCOUNT} -gt 4900 ]
then
let VERSION=VERSION+1
fi
fi
HISTFILE=${HOME}/.shistory_${DATE}.${VERSION}
export HISTFILE
HISTSIZE=5000
export HISTSIZE