I've done some research and it looks like that the way linux keeps history is less about security and audit and more about helping the user.

Even after making changes to instantly log the command and space commands the command still wont log till finished.

Is there any way to improve audit logging other then possibly writing a module for the linux kernel that will instantly log whatever is typed?

  • You saw the audit tag -- how much have you looked at that?
    – Jeff Schaller
    Commented Sep 15, 2020 at 11:52

1 Answer 1


The shell command history is not an auditing tool, although misguided people may attempt to use it as such.

The audit subsystem, on the other hand, can be set to record every exec() system call and their arguments, and/or any file accesses.

You could install sudosh2 and use it as the login shell for users. It will record everything that happens in the session, both commands and their outputs.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .