I logged into a server as root and did
w, this let me see that a user was editing a file.
someuser pts/5 10.117.0.53 14:03 3:25 1.20s 1.14s vi somefile.py
Then I disconnected, and reconnected as root again later. I did a
w again but this time it showed something different.
someuser pts/5 10.117.0.53 14:03 5:20 0.20s 0.02s sshd: someuser [priv]
I can tell from the other fields that this is the same user, but this time what they're doing is hidden.
Why did it become hidden? How do I see what they're doing?