How to view command history of another user in Linux?
On Debian-based operating systems, doing
tail /var/log/auth.log | grep username
should give you a user's sudo
history. I don't believe there is a way to get a unified command history of a user's normal + sudo commands.
On RHEL-based operating systems, you would need to check /var/log/secure
instead of /var/log/auth.log
.
Just tested the following, and it worked like a charm.
sudo vim /home/USER_YOU_WANT_TO_VIEW/.bash_history
If the user issued a command as in sudo somecommand
, the command will appear in the system log.
If the user spawned a shell with eg, sudo -s
, sudo su
, sudo sh
, etc, then the command may appear in the history of the root user, that is, in /root/.bash_history
or similar.