Linux Tips

Bash History Monitoring: 5 Ways to Audit Linux Commands

- by John Britto - Leave a Comment - 1 min read
Quick Linux Tip #105:

Question: I need to audit what root users typed in their sessions.

Try: sudo tail -f /root/.bash_history /home/*/.bash_history 2>/dev/null

Info: Streams multiple history files concurrently with header markers for simple multi-user monitoring.

Examples:

  • $ echo 'export HISTTIMEFORMAT="%F %T "' >> ~/.bashrc  # Add precise timestamps to history
  • $ echo 'PROMPT_COMMAND="history -a"' >> ~/.bashrc  # Append commands immediately per line
  • $ sudo auditctl -w /etc/passwd -p wa -k passwd_watch  # Advanced system auditing via auditd

Note: Bash flushes history on session logout by default unless PROMPT_COMMAND="history -a" is enabled. For immutable, tamper-proof session logging, utilize auditd or centralized syslog.




LinuxTeck.com 
linuxteck:~$ sudo tail -f /root/.bash_history /home/*/.bash_history 2>/dev/null
==> /root/.bash_history <==
systemctl restart nginx
vi /etc/nginx/nginx.conf
cat /var/log/syslog | grep -i error

==> /home/linuxteck/.bash_history <==
ssh linuxteck@prod-db-01
mysqldump production_db > /tmp/backup.sql
rsync -avz /tmp/backup.sql backup:/backups/

==> /home/admin/.bash_history <==
sudo apt update
sudo apt upgrade -y
sudo reboot
linuxteck:~$

PREVIOUS ARTICLE Quick Linux Tip #104: Linux Free Space Wiping: 4 Steps to Overwrite Deleted Data
About John Britto

John Britto Founder & Chief-Editor @LinuxTeck. A Computer Geek and Linux Intellectual having more than 20+ years of experience in Linux and Open Source technologies.

View all posts by John Britto →

Leave a Reply

Your email address will not be published.