Yogesh provides a really cool answer. But it works only after the user's next login or shell session. What if you want to do this in real time? You'd have to examine the user's shell's memory to see what commands have been run. It'd be a bit cryptic, but it can be done. Use gcore (provided with gdb) to dump the core. Make sure you have lots of free disk space in your current dir and then run gcore <pid>. After this, you can hunt and search with:
Start searching for the last line recorded in the user's history file; lines after that could be the ones you are looking for.
interesting thought. How about logging out the user session. This should flush the contents of his history into the file. Is it possible to force logout a user? Secondly, is it possible to flush his existing history in memory to file without logging him out?
really the history command should have a -u (user) option for the root that could take in a session/pid parameter as well..
There is a small issue with yogesh's approach. If you have multiple sessions open to a host then all will write to the same history file. this can cause potential issues..
Hi
I have been asked to find out how to
1) create users
2) reset passwords
3) kill processes that may require root privileges
without having root password, sudo rights or rights to passwd command
Any ideas?
Thanks in advance (1 Reply)
Dear
i have installed Solaris 10 on SUN V240
after installation i can not access system through root user
if i access system through any other user it conects but root is not connecting through LAN
if i connect through SC and then access root though cosole -f command it also works
kindly... (6 Replies)
Team ,
using fc command we can get details of our history file .. Is it possible to get the same result for different user from root.. Actually I need to collect all the stuff from select users history file for day to day basis.
thanks in advance .. (2 Replies)
hi
i am new to unix and i have abig task. i have to \run particular commands having root privileges from a non root user. i know sudo is one of the way but i need sum other approach kindly help
Thanks (5 Replies)
Hi all,
My need is :
1. To know who , when , which command used.
2. Local user should not delete this information.
I mean , with an example , i can say
i have a user user1
i need to give all the following permissions to user1, :
a. A specific directory other than his home... (3 Replies)
Hi all,
My need is :
1. To know who , when , which command used.
2. Local user should not delete this information.
I mean , with an example , i can say
i have a user user1
i need to give all the following permissions to user1, :
a. A specific directory other than his home... (1 Reply)
Currently in my system Red Hat is installed. And Many user connect to my machine via SSH Techia Terminal.
I want to give some users a root level access.
Can anyone please help me how to make it possible. I too searched on the Google but didn't find the correct way
Regards
ADI (4 Replies)
Hello Gurus,
I want One user to su to another without allowing root access and password.
I want to run a specific command as below from user am663:
---------------------------------------------------------
sudo -u appsprj4 /home/appsrj4/scripts/start_apache.sh
-------------------
But... (6 Replies)
Hello,
It is Solaris-10. There is a file as /opt/vpp/dom1.2/pdd/today_23. It is always generated by root, so owned by root only.
This file has to be deleted as part of application restart always and that is done by app_user and SA is always involved to do rm on that file.
Is it possible to give... (9 Replies)
I'm exploring OpenBSD and want to stick to its default shell, which is ksh. My goal is for my regular user ("bruno") and root user to have a shared history file. However, it seems that when running as root, ksh refuses to write to a HISTFILE that is owned by non-root user. This illustrates the... (3 Replies)
Discussion started by: DevuanFan
3 Replies
LEARN ABOUT SUSE
history
history(n) Tcl Built-In Commands history(n)
__________________________________________________________________________________________________________________________________________________NAME
history - Manipulate the history list
SYNOPSIS
history ?option? ?arg arg ...?
_________________________________________________________________DESCRIPTION
The history command performs one of several operations related to recently-executed commands recorded in a history list. Each of these
recorded commands is referred to as an "event". When specifying an event to the history command, the following forms may be used:
[1] A number: if positive, it refers to the event with that number (all events are numbered starting at 1). If the number is negative,
it selects an event relative to the current event (-1 refers to the previous event, -2 to the one before that, and so on). Event 0
refers to the current event.
[2] A string: selects the most recent event that matches the string. An event is considered to match the string either if the string
is the same as the first characters of the event, or if the string matches the event in the sense of the string match command.
The history command can take any of the following forms:
history
Same as history info, described below.
history add command ?exec?
Adds the command argument to the history list as a new event. If exec is specified (or abbreviated) then the command is also exe-
cuted and its result is returned. If exec is not specified then an empty string is returned as result.
history change newValue ?event?
Replaces the value recorded for an event with newValue. Event specifies the event to replace, and defaults to the current event
(not event -1). This command is intended for use in commands that implement new forms of history substitution and wish to replace
the current event (which invokes the substitution) with the command created through substitution. The return value is an empty
string.
history clear
Erase the history list. The current keep limit is retained. The history event numbers are reset.
history event ?event?
Returns the value of the event given by event. Event defaults to -1.
history info ?count?
Returns a formatted string (intended for humans to read) giving the event number and contents for each of the events in the history
list except the current event. If count is specified then only the most recent count events are returned.
history keep ?count?
This command may be used to change the size of the history list to count events. Initially, 20 events are retained in the history
list. If count is not specified, the current keep limit is returned.
history nextid
Returns the number of the next event to be recorded in the history list. It is useful for things like printing the event number in
command-line prompts.
history redo ?event?
Re-executes the command indicated by event and returns its result. Event defaults to -1. This command results in history revision:
see below for details.
HISTORY REVISION
Pre-8.0 Tcl had a complex history revision mechanism. The current mechanism is more limited, and the old history operations substitute and
words have been removed. (As a consolation, the clear operation was added.)
The history option redo results in much simpler "history revision". When this option is invoked then the most recent event is modified to
eliminate the history command and replace it with the result of the history command. If you want to redo an event without modifying his-
tory, then use the event operation to retrieve some event, and the add operation to add it to history and execute it.
KEYWORDS
event, history, record
Tcl history(n)