26

How can I view the command history of another user?

I am an admin on my machine. I can see normal history by viewing /home/user_name/.bash_history but I can't see commands of that user_name when they were doing sudo.

Is there a way to view all command executed by one user?

migrated from stackoverflow.com Jul 11 '11 at 23:51

This question came from our site for professional and enthusiast programmers.

  • 1
    Steal his password :) or by social engineering ..If you are not root, and your account is set up in a way that you can't get go/read other user's home/files you are pretty much restricted. – ring bearer Jul 11 '11 at 21:50
  • 8
    "I am an admin on my machine." – Kerin Jul 11 '11 at 21:52
23

On Debian-based operating systems, doing tail /var/log/auth.log | grep username should give you a user's sudo history. I don't believe there is a way to get a unified command history of a user's normal + sudo commands.

On RHEL-based operating systems, you would need to check /var/log/secure instead of /var/log/auth.log.

  • Any clue what this would be on a centos system? My Centos 7 machines don't have a /var/log/auth.log – Mitch Feb 1 '16 at 21:41
  • 3
    Try /var/log/secure instead. – Kerin Feb 3 '16 at 16:19
  • Works perfectly! Just put in an edit request on your answer – Mitch Feb 3 '16 at 17:21
2

Just tested the following, and it worked like a charm.

sudo vim /home/USER_YOU_WANT_TO_VIEW/.bash_history
  • 1
    S/he's already aware of this command. From the original question: "I can see normal history by viewing /home/user_name/.bash_history but i can't see commands of that "user_name" when they were doing sudo." – Michael Thompson Feb 18 '16 at 18:58
1

If the user issued a command as in sudo somecommand, the command will appear in the system log.

If the user spawned a shell with eg, sudo -s, sudo su, sudo sh, etc, then the command may appear in the history of the root user, that is, in /root/.bash_history or similar.

  • 1
    Where is the system log? – Garrett May 17 '14 at 1:05
0

Maybe this link has a value to you : http://www.sudo.ws/pipermail/sudo-users/2000-March/000052.html

But you should mind that leaving no trace in bash_history is just a matter of starting a command with a space etcpp. The history is a helper, not a logging-tool.

Greetings from Germany, Daniel Leschkowski

0

# zless /var/log/auth* is your friend here. It opens even the gzipped files. You can jump between those with :n forwards or :p backwards.

Alternatively, you can use # journalctl -f -l SYSLOG_FACILITY=10 for instance. Read more about this on the Arch Linux wiki

0

use below command

sysdig -c spy_users

if sysdig not installed, install here

-1

The logic applies to many other objectives.
And how to read .sh_history of each user from /home/ filesystem? What if there are thousands of them?

#!/bin/ksh
last |head -10|awk '{print $1}'|
 while IFS= read -r line
 do
su - "$line" -c 'tail .sh_history'
 done

Here is the script.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.