bash history line

[TeaM17cr]

hey i'm new to ll of unix and i'm kinda in a pickle atm... i need to make a program and asap so that i can see the command line history of a user on a terminal and no i cannot use the "history" command, need it to be in editing mode, it needs to be a program in bash :/

if anyone can help me out i'd really appreciated. thank you very much

[Steven E. Protter · Accepted solution]

Shalom,

First see that history is being collected.

echo $HISTFILE

After you see there is a history you can grep it or cat it or less it or tail it to get the output you want

cp $HISTFILE newfile

Done, editable output.

SEP

[TeaM17cr]

thx, but that's not what i need.. i need to make a program in bash that prints out the commands used by a user with the posibility of chosing the period in wich the command was typed. :( i don't need just 1 command. it has to be a program

[Fredrik.eriksson]

The history file does not contain dates or anything that would indicate which time the user did this command. If you wish to do this i'd suggest looking for some kind of auditing tool that would do this for you.

Linux normally doesn't log what commands are run except for the history file (which afaik does not support this action)

What you could do thou is copy out the history file for that user every day. But to make sure you get just that current days history you'd have to clear the history file every time you copy it.

This would be a bother for the users since the histfile is what makes it possible to use up-arrow.

There probably are methods of doing this but if you have alot of history files then this could be damaging to performance.

Just of the top of my head I would say a cronjob that runs every minute that reads all the history files for new entries (this is a bit tricky thou) and either fixes a date via 'date' command or insert into a database with a timestamp column.

Best regards
Fredrik Eriksson

[H.Becker]

HISTTIMEFORMAT="%D %T "
gets you timestamps into $HISTFILE.

[Fredrik.eriksson]

Apperantly I stand corrected. Didn't know about that :)

Best regards
Fredrik Eriksson