See what a user did with date/time?

Question

I am trying to see what a specific linux user on my system did, and I looked at bash_history, but it doesn't have any dates.

Is there a method I can look at that would give me dates/time?

Answer 1

From what I know, there is (per default) no definite log that associate date/time with each command launched by an user.

However you can try to guess the actions an user did by tallying informations from the command last (which will give you the dates and time when the users logged on the system) with the logs you'll find in /var/log such as syslog.

With chance the command issued some log output in one of the different logs available.

Additionally you can check dates and time of creation/modification of files that you suspect having been affected by the commands you saw in the bash_history, this could give you some more hints on what happened.

Answer 2

This would not passively update .bash_history but it would make this task easier in the future.

History timestamps can be done by exporting a variable called HISTTIMEFORMAT you would set it to the format that you would like the timestamp to look like using strftime formatting found by running the command man strftime or here

Example:

export HISTTIMEFORMAT="%F %T: "

I would suggest putting this in ~/.bashrc