Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

is there a way to stream/monitor/log bash history to prevent the ability of someone hiding stuff?

would like to monitor and know every little thing that happens so that the list of commands and edited files can be checked and watched.

Would rsync be an ideal way or is there an actual program that can be installed.

share|improve this question

closed as not constructive by mdpc, Ward, Michael Hampton, Scott Pack, Magellan Jan 15 '13 at 3:11

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

No you can't, primarily because it's trivial for any user to prevent bash from writing the history file in the first place.

If you really want to audit system activity, use the auditd daemon; that's what it's for.

share|improve this answer
Shameless plug; – Matthew Ife Jan 14 '13 at 21:48

You'd probably have to modify the bash shell programming to do what you want. Although there is history provided by the bash shell, this can be easily overridden by the user. Of course, then from bash a user could go to another shell without logging.

share|improve this answer

But if bash was the only shell available to the user, it could still work. Perhaps by using a cron job to rsync the history file periodically. It would be quite easy to tamper with the file in 1 minute however.

An Alternative: Setup a named pipe called ~/.bash_history which uses netcat to forward the commands from bash to a remote host?

share|improve this answer

Look into Extended file attributes - Wikipedia, the free encyclopedia, this will help you keep your user's .bash_history file without tempering with it.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.