Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Can anybody show me how to view command history of another user? I am an admin on my machine. I can see normal history by viewing /home/user_name/.bash_history but i can't see commands of that "user_name" when they were doing sudo.

Is there a way to view all command executed by one user?

Thanks,

Sean

share|improve this question

migrated from stackoverflow.com Jul 11 '11 at 23:51

This question came from our site for professional and enthusiast programmers.

    
Steal his password :) or by social engineering ..If you are not root, and your account is set up in a way that you can't get go/read other user's home/files you are pretty much restricted. –  ring bearer Jul 11 '11 at 21:50
2  
"I am an admin on my machine." –  Kerin Jul 11 '11 at 21:52
add comment

3 Answers 3

up vote 6 down vote accepted

Doing tail /var/log/auth.log | grep username should give you a user's sudo history. I don't believe there is a way to get a unified command history of a user's normal + sudo commands.

share|improve this answer
add comment

If the user issued a command as in sudo somecommand, the command will appear in the system log.

If the user spawned a shell with eg, sudo -s, sudo su, sudo sh, etc, then the command may appear in the history of the root user, that is, in /root/.bash_history or similar.

share|improve this answer
    
Where is the system log? –  Garrett May 17 at 1:05
add comment

Maybe this link has a value to you : http://www.sudo.ws/pipermail/sudo-users/2000-March/000052.html

But you should mind that leaving no trace in bash_history is just a matter of starting a command with a space etcpp. The history is a helper, not a logging-tool.

Greetings from Germany, Daniel Leschkowski

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.