How can I view the command history of another user?

I am an admin on my machine. I can see normal history by viewing /home/user_name/.bash_history but I can't see commands of that user_name when they were doing sudo.

Is there a way to view all command executed by one user?

  • 1
    Steal his password :) or by social engineering ..If you are not root, and your account is set up in a way that you can't get go/read other user's home/files you are pretty much restricted. Jul 11, 2011 at 21:50
  • 10
    "I am an admin on my machine."
    – Kerin
    Jul 11, 2011 at 21:52

7 Answers 7


On Debian-based operating systems, doing tail /var/log/auth.log | grep username should give you a user's sudo history. I don't believe there is a way to get a unified command history of a user's normal + sudo commands.

On RHEL-based operating systems, you would need to check /var/log/secure instead of /var/log/auth.log.

  • Any clue what this would be on a centos system? My Centos 7 machines don't have a /var/log/auth.log
    – Mitch
    Feb 1, 2016 at 21:41
  • 6
    Try /var/log/secure instead.
    – Kerin
    Feb 3, 2016 at 16:19
  • Works perfectly! Just put in an edit request on your answer
    – Mitch
    Feb 3, 2016 at 17:21

Just tested the following, and it worked like a charm.

sudo vim /home/USER_YOU_WANT_TO_VIEW/.bash_history
  • 2
    S/he's already aware of this command. From the original question: "I can see normal history by viewing /home/user_name/.bash_history but i can't see commands of that "user_name" when they were doing sudo." Feb 18, 2016 at 18:58

use below command

sysdig -c spy_users

if sysdig not installed, install here


If the user issued a command as in sudo somecommand, the command will appear in the system log.

If the user spawned a shell with eg, sudo -s, sudo su, sudo sh, etc, then the command may appear in the history of the root user, that is, in /root/.bash_history or similar.

  • 1
    Where is the system log?
    – Garrett
    May 17, 2014 at 1:05

# zless /var/log/auth* is your friend here. It opens even the gzipped files. You can jump between those with :n forwards or :p backwards.

Alternatively, you can use # journalctl -f -l SYSLOG_FACILITY=10 for instance. Read more about this on the Arch Linux wiki


Maybe this link has a value to you : http://www.sudo.ws/pipermail/sudo-users/2000-March/000052.html

But you should mind that leaving no trace in bash_history is just a matter of starting a command with a space etcpp. The history is a helper, not a logging-tool.

Greetings from Germany, Daniel Leschkowski


The logic applies to many other objectives.
And how to read .sh_history of each user from /home/ filesystem? What if there are thousands of them?

last |head -10|awk '{print $1}'|
 while IFS= read -r line
su - "$line" -c 'tail .sh_history'

Here is the script.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.