We are going through a process to make our linux servers more secure following a scan. I notice that on some of the machines, we now have lines like:
LANG=C; printf "priv_escl_start_%s" "[random 8 alnum]"; su root -c 'printf "command_start_%s" "[random 8 alnum]"; LC_ALL=C cat '\''/proc/31434/cmdline'\'' 2>/dev/null; printf "command_done_%s" "[random 8 alnum]"'; printf "priv_escl_end_%s" "[random 8 alnum]"
which spam the history file for root. For this reason, it's impossible to know what was run by root previously since these messages easily outgrow HISTSIZE. I'm not entirely sure which change to what file enabled the privelege start/end to history. I don't mind logging, but not to the history file.