How to shadow copy records to a file?

Question

linux

You need to keep track of changes made to .bash_history so that you can see which lines the user has deleted from this file. Those. some background program or service is supposed to be launched, which is guaranteed to save all commands entered by the root user. Perhaps you can recommend some spyware.
PS In principle, this task is not difficult to implement and most with the help of the poll system call

Answer 1

inotify, and in general if the user has root, he can do anything.
+ Commands starting with a space are not written to history!

Answer 2

If for the root, then this is a completely stupid idea. What's stopping him from killing this background program and doing history -c ?
And so, yes - inotify in the wrapper of a small bash script, the package is in all standard turnips.