I am trying to see what a specific linux user on my system did, and I looked at bash_history, but it doesn't have any dates.
Is there a method I can look at that would give me dates/time?
From what I know, there is (per default) no definite log that associate date/time with each command launched by an user.
However you can try to guess the actions an user did by tallying informations from the command
With chance the command issued some log output in one of the different logs available.
Additionally you can check dates and time of creation/modification of files that you suspect having been affected by the commands you saw in the bash_history, this could give you some more hints on what happened.
This would not passively update .bash_history but it would make this task easier in the future.
History timestamps can be done by exporting a variable called
I would suggest putting this in ~/.bashrc