By default, the username, ipaddress and timestamp are not recorded in the history log. You cannot see who gave the commands that rebooted your server or who removed that file? A little adjustment takes care about that. Be aware that all existing recorded commands will get the “turned on” timestamp. It will not change the old lines.

Howto add it for the current user?

Edit bash: vi ~/.bashrc

Add the following line at the bottom ( include extra line beneath it ):

HISTTIMEFORMAT=”who | awk '{print $1}' who | awk '{print $5}' %F %T “

Save it and reload the file: source ~/.bashrc

From now on, history will looks like this:

651 root (<your external ipaddress>) 2020-03-23 04:40:35 vi ~/.bashrc
652 root (<your external ipaddress>) 2020-03-23 04:42:59 source ~/.bashrc
653 root (<your external ipaddress>) 2020-03-23 04:43:01 history

Visits: 772

By angioni

Leave a Reply

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.