Where can I get root's history except besides .sh_history? I've gotten some information but only from .sh_history and the history command.


That's the only place you'll find it unless the system has auditing enabled. In which case, depending on how the auditing is setup, you'll get a detailed list of the commands that were run.

What gets logged when using auditing (auditd is the service you have to have installed) is a pretty broad question, I'd check out the documentation if you're interested in exploring that further.

But again this is not typically enabled by default so you'd need to check with your admins of the system to see if it's enabled. If it isn't, then your only course of action to getting a history of the root user's history is from the history file that the shell maintains, typically /root/.bash_history if the account is setup to use Bash as the shell.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.