User history

[mrk_1]

Hi,

I want to check perticular user history. As I am root user, how do i check the user command history. I checked in .sh_history. But it shows only root user history.

Could any one help me pls?

Thanks.

[V. Nyga]

Hi,

user history is in the home directory of the user - there can't be root history ...

Volkmar

[mrk_1]

Hi,

I logged as a root, then switch to perticular user and gave cat .sh_history command. But it showing permission denied. I was wondering to see it.

Thanks.

[V. Nyga]

Hi again,

should be no problem for the root user ...
can you copy it or change permissions?

What os do you have?

V.

[mrk_1]

Hi Nyga,

Thanks lot. I can see it using change the file permission . Is it possible to see the time also. I can see all the command without time.

Thanks.

[V. Nyga]

Hi,

no, not with this shell feature - it only saves the commands.
You should have to search for scripts for doing this (maybe like echo the date then read changes of the history)

V.

[mrk_1]

Thanks V. I will try to wirte a script to find out the sol.
Thanks lota gain.

[Court Campbell]

as root just cat or grep /home/username/.sh_history or just do then all at once /home/*/.sh_history

[mrk_1]

Hi Campbell,

Thanks lot . I Could see the history from cat /home/username/.sh_history also.

Thanks.

[Deepak Kr]

Hi Ram,

Try this:

HISTFILE=/var/adm/crash/history/.sh_history.$LOGNAME
readonly HISTFILE
export HISTFILE
print -s "LOGIN - `date '+%m-%d-%E-%H:%M'`"
HISTSIZE=1000
export HISTSIZE

[Dennis Handly]

>then switch to particular user and gave cat .sh_history command. But it showing permission denied.

There is no need to switch to the user unless the home directory is NFS mounted and root is nobody. In that case, you can switch to the user and look at the file.

>Volkmar: should be no problem for the root user

Unless over NFS where root is less than nobody.

>Is it possible to see the time also.

The time isn't recorded. Just some binary numbers, the command number?

[V. Nyga]

Dennis:
>>Volkmar: should be no problem for the root user
>Unless over NFS where root is less than nobody.

Unless the root of this ws is annouced as root for the nfs mounted dirs too :-)
Else, I believe, also permission change wouldn't work.

But you're right, it's common for me that it works at my side, but there can be differences elsewhere.

Ramkumar - as said, as root you must not change to the particular user to view the file.

V.

[Court Campbell · Accepted solution]

This is what I use in root's .profile.

# Setup history file

WHOAMI=$(who am i | awk '{print $1}')
touch ~/.${WHOAMI}_sh_history
HISTFILE=~/.${WHOAMI}_sh_history
export HISTFILE
echo "# Open: $(date)\n\0000\c" >> $HISTFILE

You can use parts of it for other user profiles. The echo line will put a time stamp in the profile. You can go to the time stamp in the history file and review the list of commands issued since it was added.