Bash – Searching command history

Shell history files are a poor way of auditing commands. They can trivially be modified or bypassed by users. They are only useful if you trust users not to deliberately or accidentally bypass the auditing mechanism. For example, commands started from a GUI, from an editor, etc. aren't recorded this way. There are many other ways a user could launch non-logged commands and even maintain plausible deniability that they were doing it for convenience or without realizing it and not as a deliberate attempt to bypass a security measure.

If you make the history files append-only (which requires running chattr +a as root on the history file), then everything that's been recorded stays recorded, but it's still easy to bypass the recording.

Rather than keep separate history files, you could keep a single history file and back it up regularly. That will retain the date at which commands were executed, but not the terminal.

If you need to have some confidence that the logs correspond to the commands that were executed, shell history files are the wrong tool. Use the audit daemon instead. Configure it to log all execve calls.

auditctl -A exit,always -S execve

See the following questions for more information:

• Log every invocation of every SUID program?
• Process Monitor equivalent for Linux?
• Can I send auditd logs to another computer?

Add this line to .bashrc:

export PROMPT_COMMAND="history -a; history -n"

Open new terminal and check.

Explanation

• history -a appends new history lines to history file.
• history -n tells bash to read lines that is not read from history file to current history list of session.
• PROMPT_COMMAND: contents of this variable is run as regular command before bash show prompt. So every time after you execute a command, history -a; history -n is executed, and your bash history is synced.