how to modify the history file

[bullz]

Hello Gurus,

I am working on a production servers, hence all the commands I type and work are captured.
Could some one of you assist, how to modify the history file?

To be frank, in case if I do a mistake, how can get away from that :P

[Alexander Chuzhoy]

I'm not sure I understood correctly, but in order to modify the history file in bash simply edit the ~/.bash_history file.

[John Guster]

the history file helps investigation, find root cause, one better leaves it alone.

[TwoProc]

Ummm - if you make a mistake, it's far better to be able to see it exactly as typed to know the scope of the problem and how to fix. Just thinking like you're doing is just wrong, wrong, wrong.

[Prasanth V Aravind]

As a system administrator ... you should be honest to your work ..

its not good practice to hide the mistakes which you done on production servers.

its productions servers & simple mistakes can cause loss of revenue...


if you interested to know how users can edit history file .. i can give some tips...


1. As default user can "vi history" file & remove unwanted commands. but its traceable.. any body can say that user have edited history file

2. create a script in /tmp/ & put entry rm /.history in that. if user run the script .. history file will be deleted.. there is very less chance the we can trace it.

3. else user can use sed instead of rm to remove only one line/command.


But, if you have strong user mgnt utilities like power broker installed in your box. user can't hide anything . it will capture command as well as output.

sudo logging also another gud way to capture user activities.

Hope this will be helpful for you

Gudluck
Prasanth

[P Muralidhar Kini]

Hi bullz,

To modify the history file,
* If you login as root,
cd /root
vi .bash_history

* If you login as user,
cd /home/
vi .bash_history

>> To be frank, in case if I do a mistake, how can get away from that :P
I would suggest you to not make any changes to the history file.
If you do any mistake then remember that you or somebody else have to fix the
problem. When fixing the problem, it becomes important to know what was the
set of commands that were executed on that system. To root cause the issue
the history file may provide clues.

As you are working on a production server, firstly you need to be sure of
what you are doing on the production server. This forum is always there for
any clarification that you may need.

Hope this helps.

Regards,
Murali

[bullz]

Thanks all