I am trying to see what a specific linux user on my system did, and I looked at bash_history, but it doesn't have any dates.
Is there a method I can look at that would give me dates/time?
Super User is a question and answer site for computer enthusiasts and power users. It only takes a minute to sign up.Sign up to join this community
From what I know, there is (per default) no definite log that associate date/time with each command launched by an user.
However you can try to guess the actions an user did by tallying informations from the command
last (which will give you the dates and time when the users logged on the system) with the logs you'll find in
/var/log such as syslog.
With chance the command issued some log output in one of the different logs available.
Additionally you can check dates and time of creation/modification of files that you suspect having been affected by the commands you saw in the bash_history, this could give you some more hints on what happened.
This would not passively update .bash_history but it would make this task easier in the future.
History timestamps can be done by exporting a variable called
HISTTIMEFORMAT you would set it to the format that you would like the timestamp to look like using strftime formatting found by running the command
man strftime or here
export HISTTIMEFORMAT="%F %T: "
I would suggest putting this in ~/.bashrc