3

I know there is the $HISTFILE variable where i can find the currently logged in users history-file, but how can i be sure to get every history file on the server

I was thinking of the following:

sudo find /home/ -name '*_history*'

With output:

root@anders:~# sudo find /home/ -name '*_history*'
/home/seb/.bash_history
/home/adionditsak/.bash_history
/home/jakob/.bash_history
...

Would this do the trick - or do you have a better way?

Improve this question
6
  • You're assuming that everyone is a) recording history, b) using the same shell and c) not changing the location of their own history. You'll need to either accept a 70% success rate on your approach, or you'll need to scan config files in every user's home directory, work out where (if) they are storing history and look there. Good luck.
    – EightBitTony
    Jul 16, 2014 at 14:06
  • But this scans for all files ending on _history in all home directories? Means all history files for all CLI's? Both Bash, Zsh, Sh, Redis, MySQL etc., and it scans in all directories under /home/. Of course they can disable history logging, but then there is no meaning in this. Need further explanation.
    – Adionditsak
    Jul 16, 2014 at 14:15
  • So if I change $HISTFILE in my session to ~/whateveh.out, then how will your find find it?
    – EightBitTony
    Jul 16, 2014 at 14:20
  • You are missing the point - I can choose to name my history file anything I like, so if you don't check the $HISTFILE value on a per user basis you can't find them.
    – EightBitTony
    Jul 16, 2014 at 14:23
  • This is getting into discussion territory so last one from me - my point isn't whether it's common, it's whether you need to include all cases. That's why I said 70% (random guess). What you're asking is actually much more complicated than it looks at first glance, because you're not in control of the source data in any way.
    – EightBitTony
    Jul 16, 2014 at 16:23

1 Answer 1

Reset to default
1

You could create a single directory for all history files and set HISTFILE in /etc/profile accordingly. For example HISTFILE=/var/somedir/history/${USER}_history Then you have a single location with all history files. A user can however override HISTFILE, for example in her .bashrc.

Improve this answer
2
  • Exactly, basically, you're (the sysadmin) not in control of how and where users record their command history, and as such 'locating all of it' is going to be very difficult. There are probably solutions which record command history outside of the shell functions, auditing tools and the like.
    – EightBitTony
    Jul 16, 2014 at 14:22
  • 1
    AFAIK you can compile bash with the option SYSLOG_HISTORY to log directly to syslog. That would solve the "don't trust the user" problem.
    – tlo
    Jul 16, 2014 at 14:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.