5

In Linux, generally we use a lot of commands and it is difficult to remember all of them.

 history

command provides the list of commands we used previously but its limit is less. New commands are overwritten on old commands then old commands are missing. I think somewhere the log of the commands is stored in the system.

Is that log available to open and read? If possible can we change the maximum size of log that it can handle?

Is the output of history command depends upon the login-user?

6

The file ~/.bash_history saves the list of executed commands. At least in CentOS this file exists, I don't know if it exists in other distros.

  • In ubunutu file ~/.bash_history exists – Abdul Gafoor Oct 8 '15 at 12:54
  • 3
    @AbdulGafoor yes, but that's what you see when you run history. It will only have as many commands as those returned by history. To keep more, you need to set the variables I show in my answer. – terdon Oct 8 '15 at 14:07
  • This file also exists in Mac OSX. You can type vim ~/.bash_history to see the contents of the file under Mac. – ILikeTurtles Oct 8 '15 at 14:27
  • It's the HISTFILE variable which sets the location history file, which by default (for bash) is ~/.bash_history – DarkHeart Oct 9 '15 at 0:34
14

A simple solution is to increase the number of commands saved and returned by history. If you use bash, add this line to your ~/.profile:

export HISTSIZE=100000
export HISTFILESIZE=999999

From man bash:

   HISTFILESIZE
          The maximum number of lines contained in the history file.  When
          this  variable  is  assigned  a value, the history file is trun‐
          cated, if necessary, to contain no  more  than  that  number  of
          lines  by removing the oldest entries.  The history file is also
          truncated to this size after writing it when a shell exits.   If
          the  value  is  0,  the  history file is truncated to zero size.
          Non-numeric values and numeric values  less  than  zero  inhibit
          truncation.   The  shell  sets the default value to the value of
          HISTSIZE after reading any startup files.
   HISTSIZE
          The number of commands to remember in the command  history  (see
          HISTORY  below).   If  the value is 0, commands are not saved in
          the history list.  Numeric values less than zero result in every
          command  being  saved  on  the history list (there is no limit).
          The shell sets the  default  value  to  500  after  reading  any
          startup files.
  • Is there any log file that linux maintains for commands ? – Abdul Gafoor Oct 8 '15 at 12:14
  • @gafoor yes, the history file I mention in my answer. Nothing else by default. If you set the variables I shows, you will keep a list of thousands of commands. – terdon Oct 8 '15 at 12:15
  • Is the output of history command depends upon the login-user? – Abdul Gafoor Dec 22 '15 at 13:00
  • @AbdulGafoor yes, each user has their own history file. – terdon Dec 22 '15 at 13:01
  • can root user see all the user's history ? – Abdul Gafoor Dec 22 '15 at 13:03
6

There is no such log, at least not by default.

There are tools you can install, like acct ("GNU Accounting utilities for process and login accounting") which can keep track of all programs executed on the system.

acct is packaged for most (probably all except tiny-distros) linux distros. The home page is at http://www.gnu.org/software/acct/

acct provides the following commands, lastcomm probably does what you're asking for:

ac prints statistics about users' connect time. ac can tell you how long a particular user or group of users were connected to your system, printing totals by day or for all of the entries in the wtmp file.

accton turns accounting on or off.

lastcomm lists the commands executed on the system, most recent first, showing the run state of each command. With last, you can search the acct file for a particular user, terminal, or command.

sa summarizes the information in the acct file into the savacct and usracct file. It also generates reports about commands, giving the number of invocations, cpu time used, average core usage, etc.

dump-acct dump-utmp display acct and utmp files in a human-readable format.

  • Upvote over the other answers simply for precision of answering the query of OP. There is no such log by default. The OP is incorrect that there is some other, special log. The default log OP mentions is the right one, OP simply needs to modify settings to match requirements. – 0xSheepdog Oct 8 '15 at 16:20
2

I am going to take a different approach to answering your question. While the ~/.bash_history log does log commands, scripts, one-liners, etc. the user has full control over their history.

From a SA's point of view you probably do not want this, instead you may want to audit what is executed on the system?

How I do this is by using auditd; some example rules are below for /etc/auditd/auditd.rules: -w /sbin/mkfs -p x -k sbin_mkfs -w /sbin/mke2fs -p x -k sbin_mke2fs -w /sbin/mkswap -p x -k sbin_mkswap -w /sbin/mkinitrd -p x -k sbin_mkinitrd -w /sbin/modinfo -p x -k sbin_modinfo -w /sbin/modprobe -p x -k sbin_modprobe

auditd would then log to /var/log/audit/ when any of the above commands are executed (-p x) and you can then view all commands that were executed on the system and by whom. It has a buffer that you specify its size with, can configure auditd to overwrite old logs, etc.

This seems to be what you want?

0

Note that if you don't use bash, it won't be in ~/.bash_history, but ~/.<shell name>_history. For example, I use zsh, my log is in ~/.zsh_history.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.