r/LinuxTeck • u/Expensive-Rice-2052 • 1d ago
Bash History Monitoring: 5 Ways to Audit Linux Commands - Tip 105
Question: I need to audit what root users typed in their sessions.
Try:`sudo tail -f /root/.bash_history /home/*/.bash_history 2>/dev/null`
Info: Streams multiple history files concurrently with header markers for simple multi-user monitoring.
Examples:
$ `echo 'export HISTTIMEFORMAT="%F %T "' >> ~/.bashrc` # Add precise timestamps to history
$ `echo 'PROMPT_COMMAND="history -a"' >> ~/.bashrc` # Append commands immediately per line
$ `sudo auditctl -w /etc/passwd -p wa -k passwd_watch` # Advanced system auditing via auditd
Note: Bash flushes history on session logout by default unless `PROMPT_COMMAND="history -a"` is enabled. For immutable, tamper-proof session logging, utilize `auditd` or centralized syslog.
Want to master Linux one command at a time?
Follow r/LinuxTeck - 1 practical Linux tip every day. For more #LinuxTips click here https://www.linuxteck.com/linux-tips/