0

While normal users have a .bash_history in their home directory, the www-data user does not have a home directory.

As such, are there any means to track the history of the www-data user?

closed as off-topic by mdpc, HBruijn, Ward, masegaloeh, Sven Nov 18 '14 at 1:24

This question appears to be off-topic. The users who voted to close gave these specific reasons:

  • "Questions must demonstrate a minimal understanding of the problem being solved. Try including attempted solutions, why they didn't work, and the expected results. See How can I ask better questions on Server Fault? for further guidance." – HBruijn, Sven
  • "Questions must be relevant to professional system administration. Server Fault is dedicated to professional system and network administrators. End user and enthusiast questions are off-topic (contact your system administrator or hire a professional to help you out). Please see the Help Center for more information." – mdpc, Ward, masegaloeh
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    Why would anyone be running bash as www-data in the first place? – Grant Nov 17 '14 at 5:29
  • i was thinking along the lines of finding out which scripts / processes ran by www-data recently. mainly for diagnostic purposes. – Reuben L. Nov 17 '14 at 7:45
  • .bash_history is not a logfile. It is tool to aid interactive shells. The main purpose is that commands you have previously used in an interactive shell can be recalled in case you need to execute the same or a very similar command at a later time. – kasperd Nov 17 '14 at 11:07
2

Process accounting could help your cause. If your kernel supports process accounting, which is something normally supported by kernels provided by distribution you need to enable process accounting by running

acct on

If you don't have acct you will need to install process accounting tools, e.g.

On centos/redhat

yum install psacct

On debian/ubuntu

apt-get install acct

and then to check what some user was running you can use

lastcomm www-data

Not the answer you're looking for? Browse other questions tagged or ask your own question.