0

While normal users have a .bash_history in their home directory, the www-data user does not have a home directory.

As such, are there any means to track the history of the www-data user?

3
  • 2
    Why would anyone be running bash as www-data in the first place?
    – Grant
    Nov 17, 2014 at 5:29
  • i was thinking along the lines of finding out which scripts / processes ran by www-data recently. mainly for diagnostic purposes.
    – Reuben L.
    Nov 17, 2014 at 7:45
  • .bash_history is not a logfile. It is tool to aid interactive shells. The main purpose is that commands you have previously used in an interactive shell can be recalled in case you need to execute the same or a very similar command at a later time.
    – kasperd
    Nov 17, 2014 at 11:07

1 Answer 1

2

Process accounting could help your cause. If your kernel supports process accounting, which is something normally supported by kernels provided by distribution you need to enable process accounting by running

acct on

If you don't have acct you will need to install process accounting tools, e.g.

On centos/redhat

yum install psacct

On debian/ubuntu

apt-get install acct

and then to check what some user was running you can use

lastcomm www-data

Not the answer you're looking for? Browse other questions tagged .