Linux последние команды пользователя

View history of commands run in terminal

To clear the history, delete the file and clear the temp history:

rm ~/.bash_history && history -c 

The history size defaults to 500 commands. You can, however, increase this by adding a line to your ~/.bashrc file to set the HISTSIZE variable:

This will not take effect immediately, but only to newly started sessions. To apply this, re-source the .bashrc file:

or run HISTSIZE=. in your current session.

By default it only keeps the latest 500 commands though. You can change the number to be kept, but you only have to accidentally start it with the default settings once, and all your older history will be gone.

You can type history on a terminal to view all the previous executed commands.

You can truncate the output to some lines (where 5 is the number of lines):

If do you want to view only commands containing a string (i.e. mv ), you can do this:

You can recall a command by typing ! followed by the entry number.

Let’s say that I have a history like this:

1 ls -la 2 mkdir foo 3 mv bar.txt foo 

• To run mkdir foo , you can type !2 .
• To run the last command, you can use !-1 or !!
• To run the penultimate, you can use !-2

If you run a command that fails because it needs root privileges (i.e. touch /etc/foo ), you can use sudo !! to run the last command as root.

• If you type !man you will execute the last command that begins with man
• If do you type !?man? it will execute the last command that contains man (not neccessarily at the line begin)

If do you have a typo in a command, you can fix it this way. Let’s say that I type cat .bash_hi , to replace .bash_hi by .bash_history I only need to type ^hi^history^ .

Источник

How to Use the Linux history Command

The history command in Linux is a built-in shell tool that displays a list of commands used in the terminal session. history allows users to reuse any listed command without retyping it.

In this tutorial, we will show you how the history command works and different ways to use it.

How to Use Linux history Command

Using the history command without options displays the list of commands used since the start of the terminal session:

To display the command history list with a limited number of entries, append that number to the history command. For instance, to show only the latest five entries, use:

Once you close the terminal, the Bash shell saves new command history entries in the .bash_history file.

Use Date and Timestamps

The .bashrc file stores the Bash shell settings. Modifying this file allows you to change the output format of the history command.

Open the .bashrc file using a text editor such as Nano:

To change the output format to include date and timestamps, add the following line to the .bashrc file:

Note: The blank space before the closed quotation marks prevents the timestamp from connecting to the command name, making the history list easier to read.

Using different arguments after HISTTIMEFORMAT allows you to customize the level of detail in the timestamp:

Save the changes to the .bashrc file, relaunch the terminal, and run the history command to confirm the new output format:

View the Size of the History Buffer

The .bashrc file contains two entries that control the size of the history buffer:

• HISTSIZE : The maximum number of entries for the history list.
• HISTFILESIZE : The maximum number of entries in the .bash_history file.

Editing the HISTSIZE and HISTFILESIZE values changes how the Bash shell displays and saves the command history.

For instance, changing the HISTSIZE value to 10 makes the history command list show a maximum of 10 latest entries.

Saving the changes to the .bashrc file, relaunching the terminal, and running the history command confirms the new output format:

Repeat a Command

Running the history command allows you to reuse any of the commands on the list. For instance, to run the first command ( sudo apt update ) again, use:

Adding a dash (—) before the command number starts the count from the end of the list. For instance, to reuse the tenth last command ( history 5 ), use:

Use double exclamation points to repeat the last command:

Search a Command by String

Adding a string after the exclamation point runs the latest command that starts with that string. For example, to reuse the latest command that begins with sudo , use:

Using this method can cause problems if the shell runs an unexpected command, especially when searching for a command that starts with sudo . As a precaution, adding the :p argument displays the command without running it, allowing you to review the command and decide if you want to execute it.

To search for a command that contains a string, but may not start with it, add a question mark next to the exclamation point. For instance, to reuse the last command that contains echo :

In the example above, the shell reuses the last command that contains the echo string even though the command starts with sudo .

Check out our article on sudo command to learn how to use the sudo command with examples.

List the Matching Commands

Combining history and grep allows you to display a list of commands that contain a string. For example, to list all commands that contain ufw , use:

Note: Learn more about using the grep command in Linux.

Change the Executed Command

Use the following syntax to change the last executed command:

For instance, the ufw command to enable port 20 shows that the port is already enabled:

Use the syntax above to change the port number from 20 to 22:

Prevent Recording Commands in History

To prevent recording commands in the history list, temporarily disable recording by using:

To re-enable recording, use:

Delete History

Use the -d option with the history command to delete a command from the history list. For instance, delete command number 87 with:

Use the -c option to clear the whole history list:

Update the History File

The Bash shell saves any updates to the command history list when you exit the terminal session. The history command also allows you to save changes while in the terminal session.

Using the -a option lets you append the command history entries from this session to the .bash_history file:

Another method is to use the -w option to save the entire history list to the .bash_history file:

After reading this tutorial, you should be able to use the history command in Linux to view, edit, and delete the command history list and reuse commands from it.

If you are interested in learning more about Linux commands, have a look at our Linux commands cheat sheet.

Источник

Как посмотреть историю команд всех пользователей в Linux?

как посмотреть историю введенных команд всех пользователей в системе, не проваливаясь под каждого юзера?

Простой 1 комментарий

Вам привели примеры при условии, если все пользователи знают только стандартный Bash.
Нередко используют и zsh и fish — у них история хранится в других местах.

grep -e «$pattern» /home/*/.bash_history
(при условии, что все пользователи лежат в /home/*)

ну или чтоб знать кто точно

getent passwd | cut -d : -f 6 | sed 's:$:/.bash_history:' | xargs -d '\n' grep -s -H -e "$pattern"

Sha644, ну немного докрутить. Я думаю, что это нужно не для того, чтоб команды из под рута смотреть. а прочих засранцев 🙂

grep -e "$pattern" /home/*/.bash_history /root/.bash_history

при корректном выходе пользователя, его история сохраняется в его домашнем каталоге в .<ШЕЛЛ>_history — например $HOME/.bash_history, $HOME/.ksh_history

Файл доступен только пользователю, или суперпользователю.
Следовательно запускайте cat от суперпользователя
sudo cat /home/ЮЗЕР/.bash_history

можно одной командой сразу все (правда эта команда скорее всего бесполезна):

Источник

How can I see all of the bash history?

In this case, the shell can not see the history executed by shell(1), but I want to see all of the bash history in every shell. So my question is how can I see all of the bash history? Does anybody know how to hack? Thank you very much in advance!

5 Answers 5

would also work, although I tend to just use

How to do it when I am working in a virtual environment (venv)? ~/.bash_history shows only the commands outside of the virtual environment.

@Raif — you would need access to the terminal within the virtual environment as the «user» running the app commands (root or the equivalent).

You should look into the histappend shell option and the -a flag to history :

histappend

If set, the history list is appended to the file named by the value of the HISTFILE variable when the shell exits, rather than overwriting the file.

history

-a Append the «new» history lines (history lines entered since the beginning of the current bash session) to the history file.

If you put history -a into your PROMPT_COMMAND , you’ll get an always-up-to-date .bash_history file.

Edit your .bashrc and append this to it’s end:

shopt -s histappend PROMPT_COMMAND="history -n; history -a" unset HISTFILESIZE HISTSIZE=2000 

You can install something like Advanced Shell History, which will log each command to a sqlite3 database. It comes with a tool for querying the database from the command line. https://github.com/barabo/advanced-shell-history

With this setup, you will have a unified view of command history across all sessions. You also get things like command history for the current working directory (or subtree), command exit code, command duration, etc.

Full disclosure: I wrote and maintain the tool.

As several have noted, you need to use shopt -s histappend . Check by running shopt and verifying that histappend is ‘on’.

To ensure that each command (across multiple concurrent shells) appears in the history for each of those shells, add this at the end of your .bashrc file:

# Skip if not an interactive shell if [ -z "$" ]; then return; fi export PROMPT_COMMAND="history -a; history -c; history -r; $" 

-a: appends the new history lines (history lines entered since the beginning of the current Bash session) to the history file.

-c: clears the history list.

-r: reads the current history file and append its contents to the history list.

Run source .bashrc or create new sessions and in several terminal windows enter the comment #Tn in each. Then on one terminal, enter history | tail -N to see the last N lines. You should see all of the comments entered on the different terminals.

It may be helpful to add the following to /etc/profile.d/bashrc.sh in order to get a timestamp on each line of the history:

if [ -z "$" ]; then return; fi export HISTTIMEFORMAT='%F %T ' 

The result looks like this:

 [moi@laBoheme ~]$ history | tail -4 3292 2019-01-22 12:41:25 # T1 3293 2019-01-22 12:41:32 # T2 3294 2019-01-22 12:41:44 # T3 3295 2019-01-22 12:41:50 history | tail -4 

Источник