up vote 3 down vote favorite
share [g+] share [fb]

Can anybody show me how to view command history of another user? I am an admin on my machine. I can see normal history by viewing /home/user_name/.bash_history but i can't see commands of that "user_name" when they were doing sudo.

Is there a way to view all command executed by one user?

Thanks,

Sean

link|improve this question
Steal his password :) or by social engineering ..If you are not root, and your account is set up in a way that you can't get go/read other user's home/files you are pretty much restricted. – ring bearer Jul 11 '11 at 21:50
2  
"I am an admin on my machine." – Kerin Jul 11 '11 at 21:52
feedback

migrated from stackoverflow.com Jul 11 '11 at 23:51

This question came from our site for professional and enthusiast programmers.

3 Answers

up vote 2 down vote accepted

Doing tail /var/log/auth.log | grep username should give you a user's sudo history. I don't believe there is a way to get a unified command history of a user's normal + sudo commands.

link|improve this answer
feedback
up vote 0 down vote

If the user issued a command as in sudo somecommand, the command will appear in the system log.

If the user spawned a shell with eg, sudo -s, sudo su, sudo sh, etc, then the command may appear in the history of the root user, that is, in /root/.bash_history or similar.

link|improve this answer
feedback
up vote 0 down vote

Maybe this link has a value to you : http://www.sudo.ws/pipermail/sudo-users/2000-March/000052.html

But you should mind that leaving no trace in bash_history is just a matter of starting a command with a space etcpp. The history is a helper, not a logging-tool.

Greetings from Germany, Daniel Leschkowski

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.