Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Can anybody show me how to view command history of another user? I am an admin on my machine. I can see normal history by viewing /home/user_name/.bash_history but i can't see commands of that "user_name" when they were doing sudo.

Is there a way to view all command executed by one user?

Thanks,

Sean

share|improve this question

migrated from stackoverflow.com Jul 11 '11 at 23:51

This question came from our site for professional and enthusiast programmers.

    
Steal his password :) or by social engineering ..If you are not root, and your account is set up in a way that you can't get go/read other user's home/files you are pretty much restricted. – ring bearer Jul 11 '11 at 21:50
3  
"I am an admin on my machine." – Kerin Jul 11 '11 at 21:52
up vote 9 down vote accepted

On Debian-based operating systems, doing tail /var/log/auth.log | grep username should give you a user's sudo history. I don't believe there is a way to get a unified command history of a user's normal + sudo commands.

On RHEL-based operating systems, you would need to check /var/log/secure instead of /var/log/auth.log.

share|improve this answer
    
Any clue what this would be on a centos system? My Centos 7 machines don't have a /var/log/auth.log – Mitch Feb 1 at 21:41
    
Try /var/log/secure instead. – Kerin Feb 3 at 16:19
    
Works perfectly! Just put in an edit request on your answer – Mitch Feb 3 at 17:21

If the user issued a command as in sudo somecommand, the command will appear in the system log.

If the user spawned a shell with eg, sudo -s, sudo su, sudo sh, etc, then the command may appear in the history of the root user, that is, in /root/.bash_history or similar.

share|improve this answer
    
Where is the system log? – Garrett May 17 '14 at 1:05

Maybe this link has a value to you : http://www.sudo.ws/pipermail/sudo-users/2000-March/000052.html

But you should mind that leaving no trace in bash_history is just a matter of starting a command with a space etcpp. The history is a helper, not a logging-tool.

Greetings from Germany, Daniel Leschkowski

share|improve this answer

# zless /var/log/auth* is your friend here. It opens even the gzipped files. You can jump between those with :n forwards or :p backwards.

Alternatively, you can use # journalctl -f -l SYSLOG_FACILITY=10 for instance. Read more about this on the Arch Linux wiki

share|improve this answer

Just tested the following, and it worked like a charm.

sudo vim /home/USER_YOU_WANT_TO_VIEW/.bash_history
share|improve this answer
    
S/he's already aware of this command. From the original question: "I can see normal history by viewing /home/user_name/.bash_history but i can't see commands of that "user_name" when they were doing sudo." – Michael Thompson Feb 18 at 18:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .