A
A
argdos2018-11-22 11:46:36
linux
argdos, 2018-11-22 11:46:36

How to view command history of all users in Linux?

how to view the history of the entered commands of all users in the system without falling through for each user?

Answer the question

In order to leave comments, you need to log in

3 answer(s)
N
Nikita Ermilichev, 2018-11-22
@Masas

grep -e "$pattern" /home/*/.bash_history
(provided that all users are in / home / *)
well, or to know exactly who

getent passwd | cut -d : -f 6 | sed 's:$:/.bash_history:' | xargs -d '\n' grep -s -H -e "$pattern"

S
Saboteur, 2018-11-22
@saboteur_kiev

when the user exits correctly, his history is saved in his home directory in .<SHELL>_history - eg $HOME/.bash_history, $HOME/.ksh_history
The file is only accessible by the user, or superuser.
Therefore, you can run cat as the superuser
sudo cat /home/USER/.bash_history with
one command all at once (although this command is most likely useless):
or even easier

cut -d: -f 6 </etc/passwd | xargs -ID sudo grep -Hs "" D/.bash_history

D
Denis, 2018-11-29
@Sat0shi

What if the shell is not bash? All *sh must be taken into account

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question