Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Can anybody show me how to view command history of another user? I am an admin on my machine. I can see normal history by viewing /home/user_name/.bash_history but i can't see commands of that "user_name" when they were doing sudo.

Is there a way to view all command executed by one user?

Thanks,

Sean

share|improve this question

migrated from stackoverflow.com Jul 11 '11 at 23:51

This question came from our site for professional and enthusiast programmers.

    
Steal his password :) or by social engineering ..If you are not root, and your account is set up in a way that you can't get go/read other user's home/files you are pretty much restricted. – ring bearer Jul 11 '11 at 21:50
3  
"I am an admin on my machine." – Kerin Jul 11 '11 at 21:52
up vote 9 down vote accepted

On Debian-based operating systems, doing tail /var/log/auth.log | grep username should give you a user's sudo history. I don't believe there is a way to get a unified command history of a user's normal + sudo commands.

On RHEL-based operating systems, you would need to check /var/log/secure instead of /var/log/auth.log.

share|improve this answer
    
Any clue what this would be on a centos system? My Centos 7 machines don't have a /var/log/auth.log – Mitch Feb 1 at 21:41
    
Try /var/log/secure instead. – Kerin Feb 3 at 16:19
    
Works perfectly! Just put in an edit request on your answer – Mitch Feb 3 at 17:21

If the user issued a command as in sudo somecommand, the command will appear in the system log.

If the user spawned a shell with eg, sudo -s, sudo su, sudo sh, etc, then the command may appear in the history of the root user, that is, in /root/.bash_history or similar.

share|improve this answer
    
Where is the system log? – Garrett May 17 '14 at 1:05

Maybe this link has a value to you : http://www.sudo.ws/pipermail/sudo-users/2000-March/000052.html

But you should mind that leaving no trace in bash_history is just a matter of starting a command with a space etcpp. The history is a helper, not a logging-tool.

Greetings from Germany, Daniel Leschkowski

share|improve this answer

# zless /var/log/auth* is your friend here. It opens even the gzipped files. You can jump between those with :n forwards or :p backwards.

Alternatively, you can use # journalctl -f -l SYSLOG_FACILITY=10 for instance. Read more about this on the Arch Linux wiki

share|improve this answer

Just tested the following, and it worked like a charm.

sudo vim /home/USER_YOU_WANT_TO_VIEW/.bash_history
share|improve this answer
    
S/he's already aware of this command. From the original question: "I can see normal history by viewing /home/user_name/.bash_history but i can't see commands of that "user_name" when they were doing sudo." – Michael Thompson Feb 18 at 18:58

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.