How to view command history of another user in Linux?

Question

How can I view the command history of another user?

I am an admin on my machine. I can see normal history by viewing /home/user_name/.bash_history but I can't see commands of that user_name when they were doing sudo.

Is there a way to view all command executed by one user?

Steal his password :) or by social engineering ..If you are not root, and your account is set up in a way that you can't get go/read other user's home/files you are pretty much restricted. — ring bearer, Jul 11 '11 at 21:50

score 39 · Accepted Answer · edited May 25 '16 at 20:47

39

On Debian-based operating systems, doing tail /var/log/auth.log | grep username should give you a user's sudo history. I don't believe there is a way to get a unified command history of a user's normal + sudo commands.

On RHEL-based operating systems, you would need to check /var/log/secure instead of /var/log/auth.log.

edited May 25 '16 at 20:47

themanatuf

103
3

answered Jul 11 '11 at 21:51

Kerin

505
4
5

Any clue what this would be on a centos system? My Centos 7 machines don't have a `/var/log/auth.log` – Mitch Feb 01 '16 at 21:41
6

Try `/var/log/secure` instead. – Kerin Feb 03 '16 at 16:19
Works perfectly! Just put in an edit request on your answer – Mitch Feb 03 '16 at 17:21

score 19 · Answer 2 · edited Nov 04 '15 at 22:16

19

Just tested the following, and it worked like a charm.

sudo vim /home/USER_YOU_WANT_TO_VIEW/.bash_history

edited Nov 04 '15 at 22:16

Excellll

12,627
11
51
78

answered Nov 04 '15 at 21:51

Tyson

199
1
2

2

S/he's already aware of this command. From the original question: "I can see normal history by viewing /home/user_name/.bash_history but i can't see commands of that "user_name" when they were doing sudo." – Michael Thompson Feb 18 '16 at 18:58

score 4 · Answer 3 · answered Jan 16 '19 at 07:16

4

use below command

sysdig -c spy_users

if sysdig not installed, install here

answered Jan 16 '19 at 07:16

sachin_ur

141
3

score 3 · Answer 4 · answered Jul 11 '11 at 21:52

3

If the user issued a command as in sudo somecommand, the command will appear in the system log.

If the user spawned a shell with eg, sudo -s, sudo su, sudo sh, etc, then the command may appear in the history of the root user, that is, in /root/.bash_history or similar.

answered Jul 11 '11 at 21:52

bdonlan

1,563
1
14
22

1

Where is the system log? – Garrett May 17 '14 at 01:05

score 1 · Answer 5 · answered Jan 03 '16 at 19:43

# zless /var/log/auth* is your friend here. It opens even the gzipped files. You can jump between those with :n forwards or :p backwards.

Alternatively, you can use # journalctl -f -l SYSLOG_FACILITY=10 for instance. Read more about this on the Arch Linux wiki

score 0 · Answer 6 · answered Jul 11 '11 at 21:58

Maybe this link has a value to you : http://www.sudo.ws/pipermail/sudo-users/2000-March/000052.html

But you should mind that leaving no trace in bash_history is just a matter of starting a command with a space etcpp. The history is a helper, not a logging-tool.

Greetings from Germany, Daniel Leschkowski

score -1 · Answer 7 · edited Sep 30 '18 at 16:42

-1

The logic applies to many other objectives.
And how to read .sh_history of each user from /home/ filesystem? What if there are thousands of them?

#!/bin/ksh
last |head -10|awk '{print $1}'|
 while IFS= read -r line
 do
su - "$line" -c 'tail .sh_history'
 done

Here is the script.

edited Sep 30 '18 at 16:42

Glorfindel

4,089
8
24
37

answered Sep 30 '18 at 16:38

Rogi

1
1

How to view command history of another user in Linux?

7 Answers7