Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am trying to see what a specific linux user on my system did, and I looked at bash_history, but it doesn't have any dates.

Is there a method I can look at that would give me dates/time?

share|improve this question
add comment

2 Answers

From what I know, there is (per default) no definite log that associate date/time with each command launched by an user.

However you can try to guess the actions an user did by tallying informations from the command last (which will give you the dates and time when the users logged on the system) with the logs you'll find in /var/log such as syslog.

With chance the command issued some log output in one of the different logs available.

Additionally you can check dates and time of creation/modification of files that you suspect having been affected by the commands you saw in the bash_history, this could give you some more hints on what happened.

share|improve this answer
add comment

This would not passively update .bash_history but it would make this task easier in the future.

History timestamps can be done by exporting a variable called HISTTIMEFORMAT you would set it to the format that you would like the timestamp to look like using strftime formatting found by running the command man strftime or here

Example:

export HISTTIMEFORMAT="%F %T: "

I would suggest putting this in ~/.bashrc

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.