Shell – Viewing bash history of separate active TTY

command historyprocshelltty

I am working on a script that will help the sysadmins on our team monitor what's going on in other terminals by other logged in users.

One thing I'm stuck on right now is how to view what commands have been typed. I realize that the history doesn't get saved until the user exits or types history -a, but there has to be a way to view what's currently in the history, even if it's stored in memory somewhere.

Is it possibly saved somewhere in /proc/${pid_of_users_bash}? I tried to type a command echoing a unique string (EG: echo "foobarbaz", then greping for foobarbaz through any flat files within the associated /proc/PID directory, but no luck.

If anyone has a solution that doesn't involve setting thePROMPT_COMMAND or setting the histappend (like these), that would be greatly appreciated.

Best Answer

Bash does not provide information you want. I think you want avoid setting COMMAND_PROMPT and histappend because users may easily overwrites them. But users may completely disable storing commands to history when they set HISTCONTROL="ignorespace" and insert a space before each command. So users that are not willing to be monitored cannot be reliably monitored via bash history.

Ad hoc monitoring a single session can be done over strace. Search for the PID of the user's bash and then call strace -p <bash-pid> 2>&1 |grep "read(0,". The you can see all characters typed by user - including typos and editing commands.

Most of linux distribution provides auditd package. It monitors and audits system components so administrator may get information about system activities in past. A PAM module pam_tty_audit cooperates with auditd and enables or disables TTY activity auditing. I guess you do not need to reinvent wheel and use the pam_tty_audit.

Related Solutions

Bash History in Script – Using ‘!#:*’

Yes, this is using history. !# is a history event designator that refers to the entire command line typed so far. :* is a word (range) designator that refers to all of the words, except the 0th. So, after you have typed echo "This is a sentence. ", then !#:* expands to "This is a sentence. ". And x-y (where x and y are integers) is a word (range) designator that refers to word number x through word number y. If y is omitted (x-), this is interpreted to mean word number x through the second to last word. So, after your “entire command line typed so far” stands as

echo "This is a sentence. " "This is a sentence. "

then !#:1- expands to "This is a sentence. ", because each of the quoted "This is a sentence. " strings counts as one word, and so !#:1- is equivalent to !#:1 (just word number 1). So you end up with

echo "This is a sentence. " "This is a sentence. " "This is a sentence. " >text3

The fact that the - and the > appear together in the command is just a confusion; they don’t interact. And the fact that “This is a sentence.” is quoted obscures what is going on; if you said

echo This is a sentence. !#:* !#:1-

it would expand to

echo This is a sentence. This is a sentence. !#:1-

and thence to

echo This is a sentence. This is a sentence. This is a sentence. This is a

(because !#:1- expands to word number 1 through the second to last word.)

Bash – Inconsistent Bash history

By default, ~/.bash_history is written to disk when an interactive session terminates. This means that if you have concurrent shells open, only the most recently terminated shell session has its history written to disk.

(technically, all sessions are written to disk, but two concurrent sessions don't know about the others' histories, so when one exits, it writes what it thinks the new history to be, and then when the other exits, it writes its history)

See https://unix.stackexchange.com/a/1292/20246 for more details.

Best Answer

Related Solutions

Bash History in Script – Using ‘!#:*’

Bash – Inconsistent Bash history

Related Question