Is it possible to get the history of all commands that were entered but just from one folder?

like the


command, but only output should only show commands that the user entered while in a certain directory

From my knowledge its not possible, but it came up in a meeting today and I would like to make 100% before telling my project manager hes foolish.

Thanks for advice.

  • That would imply that you only care about rm -rf * when it is preceded at some point by a cd /path/to/dir and don't care when a user does rm -rf /path/to/dir/ which seems very silly. - Having said that, when you configure auditd to record all commands, it will also record the current working directory cwd and you can use that to filter out the commands that were issued from a specific directory. – HBruijn Feb 13 '18 at 15:05
  • Yes I agree, it does seem silly.... your reply is very similar to the argument I put forward during my meeting today, I suspect that in future there will be some scope creep to include rm -rf /path/to/dir/ also, but for now, I do wish to only find code rm -rf * from inside the dir Thanks for the suggestion, I found this access.redhat.com/solutions/49257 which may be suitable, I will report back with results, thanks again – – Sean Davey Feb 13 '18 at 15:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.