Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I want to see all bash commands that have been run on a Linux server across multiple user accounts. The specific distribution I'm using is CentOS 5.7. Is there a way to globally search .bash_history files on a server or would it be a more home-grown process of locate | cat | grep? (I shudder just typing that out).

share|improve this question
add comment

3 Answers

up vote 4 down vote accepted

Use getent to enumerate the home directories.

getent passwd |
cut -d : -f 6 |
sed 's:$:/.bash_history:' |
xargs -d '\n' grep -H -e "$pattern" 

If your home directories are in a well-known location, it could be as simple as

grep -e "$pattern" /home/*/.bash_history

Of course, if a user uses a different shell or a different value of HISTFILE, this won't tell you much. Nor will this tell you about commands that weren't executed through a shell, or about aliases and functions and now-removed external commands that were in some user directory early in the user's $PATH. If what you want to know is what commands users have run, you need process accounting or some fancier auditing system; see monitoring activity on my computer, How to check how long a process ran after it finished?.

share|improve this answer
    
+1 for suggesting process accounting instead. History files are really for user convenience and there are no simple ways to make them fool-proof enough for any sort of logging purposes. –  jw013 Feb 15 '12 at 7:45
    
@jw013 Yes, I've already had my fill of how easy it is to edit / modify and otherwise muck with shell history. =| –  Wesley Feb 15 '12 at 16:45
add comment

You could do

find /home | grep bash_history | xargs grep "whatever"

But I don't really think that is much better then what you were thinking.

share|improve this answer
add comment

find /home -name .bash_history | xargs grep

Alternatively, grep string $(find /home -name .bash_history).

Note that this covers home directories in default locations. It would be better to parse /etc/passwd or invoke getent, and parse the output of that.

for i in $(getent passwd | cut -d: -f6 ); do grep string ${i}/.bash_history; done

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.