I'm asking because mine is strangely short and I definitely didn't clear them. However I tried changing my username (because I got some errors which I thought were due to my hostname; tried to view the history to see how I did that to change it back) and I'm not sure if that could have caused the history to be cleared?

I'm running Debian 9.1 with KDE and $HISTSIZE variable is set to its default value.

(In the root history there are also 2 commands which I can't remember having executed: filemanager /var/mail/root and texteditor /etc/nsswitch.conf for which I'd like to view diffs using etckeeper.)

  • 1
    You could check the timestamp on file /etc/nsswitch.conf to try determine when the mysterious editing took place. Someone having cleared the root bash history suggests the server may have been compromised. – steve Aug 6 '17 at 18:13
  • @steve I don't know whether it was edited. I probably just forgot about opening it. The modification date says 3 August. Well if the history is kind of lost when changing one's hostname it wouldn't require cleaning. I'm just pretty sure that I executed more commands as root than shown after running sudo -i and history (if that really shows all the root history). It's not a server. – mYnDstrEAm Aug 6 '17 at 18:18
  • do you normally use the filemanager and texteditor commands? that's fairly uncommon IME - most people have a preferred file manager and/or text editor and run them directly rather than via a symlink or alias, or use a short alias to reduce the amount of typing. – cas Aug 7 '17 at 4:56
  • @cas Sorry for not making that clear enough: it's the filemanager and texteditor that I use. I probably opened them and forgot about it (and about how the contents of that nsswitch file looked like). I had plenty of problems with name resolution earlier so I would be interested in any changes to nsswitch. – mYnDstrEAm Aug 7 '17 at 11:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.