Shell – Where to Find Log of Used Commands in Linux

I have concluded that it is not possible to append the new commands directly and at the same time to remove any duplicates. So my solution is to run the following command ones in a while. or to put it in my crontab.

tac $HOME/.bash_history | awk '!seen[$0]++' | tac > $HOME/.hist_Temp 
mv $HOME/.hist_Temp $HOME/.bash_history

The above command will keep the last occurrence of a command and remove every other repetitions above it from the history file without messing up the order.

I was intrigued by your question. I wasn't originally going to give an answer but I got hooked.

This uses expect and it's really a key logger.

#!/usr/bin/expect -f

proc log {msg} {
    puts $::fh "[timestamp -format {%Y-%m-%d %H:%M:%S}]: $msg"
}

set ssh_host [lindex $argv 0]
set ::fh [open "sshlog.$ssh_host" a]

log "{session starts}"

spawn ssh $ssh_host

interact {
    -re "(.)" {
        set char $interact_out(1,string)
        if {$char eq "\r"} {
            log $keystrokes
            set keystrokes ""
        } else {
            append keystrokes $char
        }
        send -- $char
    }
    eof
}

log "{session ends}"

Notes:

• it appends to a file with the ssh destination in the name
• it is a key logger: if you have not set up ssh keys, you get the user's password in the log file
• it is foiled by tab completion: if the user types uptTab (for the uptime command), you'll get "upt\t" in the log file, not "uptime"
• it grabs characters in "raw" mode: if the user is a bad typist, you'll get lots of ^? (backspace characters) in the log file.