How can I view the command history of another user?

I am an admin on my machine. I can see normal history by viewing /home/user_name/.bash_history but I can't see commands of that user_name when they were doing sudo.

Is there a way to view all command executed by one user?

  • 1
    Steal his password :) or by social engineering ..If you are not root, and your account is set up in a way that you can't get go/read other user's home/files you are pretty much restricted. Jul 11, 2011 at 21:50
  • 11
    "I am an admin on my machine."
    – Kerin
    Jul 11, 2011 at 21:52

7 Answers 7


On Debian-based operating systems, doing tail /var/log/auth.log | grep username should give you a user's sudo history. I don't believe there is a way to get a unified command history of a user's normal + sudo commands.

On RHEL-based operating systems, you would need to check /var/log/secure instead of /var/log/auth.log.

  • Any clue what this would be on a centos system? My Centos 7 machines don't have a /var/log/auth.log
    – Mitch
    Feb 1, 2016 at 21:41
  • 6
    Try /var/log/secure instead.
    – Kerin
    Feb 3, 2016 at 16:19
  • Works perfectly! Just put in an edit request on your answer
    – Mitch
    Feb 3, 2016 at 17:21

Just tested the following, and it worked like a charm.

sudo vim /home/USER_YOU_WANT_TO_VIEW/.bash_history
  • 2
    S/he's already aware of this command. From the original question: "I can see normal history by viewing /home/user_name/.bash_history but i can't see commands of that "user_name" when they were doing sudo." Feb 18, 2016 at 18:58

use below command

sysdig -c spy_users

if sysdig not installed, install here


If the user issued a command as in sudo somecommand, the command will appear in the system log.

If the user spawned a shell with eg, sudo -s, sudo su, sudo sh, etc, then the command may appear in the history of the root user, that is, in /root/.bash_history or similar.

  • 1
    Where is the system log?
    – Garrett
    May 17, 2014 at 1:05

# zless /var/log/auth* is your friend here. It opens even the gzipped files. You can jump between those with :n forwards or :p backwards.

Alternatively, you can use # journalctl -f -l SYSLOG_FACILITY=10 for instance. Read more about this on the Arch Linux wiki


Maybe this link has a value to you : http://www.sudo.ws/pipermail/sudo-users/2000-March/000052.html

But you should mind that leaving no trace in bash_history is just a matter of starting a command with a space etcpp. The history is a helper, not a logging-tool.

Greetings from Germany, Daniel Leschkowski


The logic applies to many other objectives.
And how to read .sh_history of each user from /home/ filesystem? What if there are thousands of them?

last |head -10|awk '{print $1}'|
 while IFS= read -r line
su - "$line" -c 'tail .sh_history'

Here is the script.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .