Checking .bash_history after the fact, it only shows the commands a user typed, and that’s only if they didn’t clear the history. A user can erase it with a single command, leaving no trace unless you already have logging enabled somewhere they can’t access.
If you need to see what users are doing on a shared system right now, or you need a record that remains even if someone tries to hide their activity, Bash history isn’t the right tool.
Let’s look at how to monitor user activity in real time, and which tools you can use when you need something more reliable than a history file stored in a user’s home directory.
1. View a User’s Bash History File
Every command a user runs in an interactive Bash shell is usually saved in a hidden file called .bash_history inside their home directory.
cat /home/ravi/.bash_history
This lets you see the commands the user has entered in previous shell sessions.
By default, however, the history file doesn’t include timestamps. You can see what commands were run, but not when they were executed.
2. Add Timestamps to Bash History
To display the date and time for each history entry, set the HISTTIMEFORMAT environment variable:
export HISTTIMEFORMAT='%F %T ' history
This format uses:
%F– Displays the date in YYYY-MM-DD format.%T– Displays the time in HH:MM:SS format.
Once set, the history command shows timestamps alongside each command, making it much easier to review activity.
If you want this enabled automatically for all users, add the following line to /etc/profile or /etc/bash.bashrc:
export HISTTIMEFORMAT='%F %T '
This only affects new shell sessions after users log in again. Keep in mind that .bash_history is not a reliable audit log. Since the file belongs to the user, they can clear it with history -c, disable history by unsetting HISTFILE, or even edit the file before logging out.
Timestamps make history more useful for reviewing your own commands, but they don’t prevent someone from removing or changing their history.
If you need a trustworthy record of user activity, you’ll need dedicated auditing tools, which we’ll cover later in the article.
3. See Who’s Logged In and What They’re Running
The w command gives you a quick overview of the users currently logged into the system. It shows who is logged in, where they connected from, how long they’ve been idle, and the command they’re currently running.
w
The output includes:
- Logged-in usernames.
- The remote host or terminal they connected from.
- Login time and idle time.
- The command or process they’re currently running.
This is useful for a quick status check, but remember that w only shows the current state of the system. It doesn’t continuously monitor user activity or keep a history of commands.
4. Monitor Commands in Real Time with Sysdig
If you need to see commands as users run them, sysdig is a much better choice. Unlike Bash history, it monitors system calls in real time, so you can watch activity as it happens.
After installing sysdig, run:
sysdig -c spy_users
Here’s what the options mean:
sysdig– Starts the system call tracing tool.-c spy_users– Uses the built-in spy_users chisel to display interactive commands and directory changes made by logged-in users.
As soon as a user presses Enter, you’ll see the command appear on your screen. This makes sysdig useful for troubleshooting or monitoring activity on a live system.
5. Record User Terminal Sessions with tlog
Sometimes watching commands in real time isn’t enough. You may also need a complete record of a user’s terminal session to review later. That’s where tlog comes in.
tlog records entire terminal sessions, including user input and terminal output, so you can replay them later for auditing or troubleshooting.
To start a recorded session manually:
tlog-rec-session
To replay a recorded session:
tlog-play -i session.log
The commands work as follows:
tlog-rec-session– Starts a terminal session that records everything the user types and everything displayed on the screen.tlog-play -i session.log– Replays the recorded session with its original timing, making it easy to review exactly what happened.
In most production environments, administrators configure tlog through PAM (Pluggable Authentication Modules) so recording starts automatically whenever users log in, without requiring them to run tlog-rec-session themselves.
RHEL, Rocky Linux, and other Red Hat-based distributions include tlog in their official repositories. It’s also available for Debian and Ubuntu, although you may need to install it manually.
6. Enable Persistent Auditing with auditd
If you need a reliable audit trail that users can’t modify, auditd is the right tool. It records system events at the kernel level and stores them in /var/log/audit/audit.log, which regular users cannot edit or delete.
To log every program that users execute on a 64-bit system, add an audit rule:
auditctl -a always,exit -F arch=b64 -S execve
To view recently recorded execution events:
ausearch -m execve -ts recent
These commands do the following:
auditctl -a always,exit -F arch=b64 -S execve– Adds a rule that records everyexecvesystem call, which is made whenever a program is executed.ausearch -m execve -ts recent– Searches the audit log for recently recordedexecveevents.
Because auditd records events at the kernel level instead of relying on a user’s shell history, it provides a much more trustworthy audit trail. This is why it’s commonly used in environments that must meet security and compliance requirements.
7. Record a Terminal Session with script
If you want to record a terminal session for troubleshooting, demonstrations, or documentation, the script command is a quick and easy option.
Start recording with:
script -a session.log
Here’s what the options mean:
-a– Appends to the existing log file instead of overwriting it.session.log– The file where the terminal session is saved.
Everything displayed in the terminal during the session is written to the log file. When you’re finished, type the following command to stop recording.
exit
The script command is lightweight and available on most Linux distributions without any additional setup. However, it only records sessions that are started manually.
For continuous system-wide auditing or recording user sessions automatically, tools such as tlog or auditd are a better choice.
Conclusion
Bash history is useful for quickly reviewing the commands a user has run, but it shouldn’t be treated as a reliable audit log since users can modify or delete it. For a quick view of current activity, the w command shows who’s logged in and what they’re doing.
If you need live monitoring, sysdig lets you watch commands as they’re executed. For long-term auditing and session recording, tlog and auditd provide a much more reliable solution that doesn’t depend on a user’s shell history.
If you use a different tool or approach to monitor user activity on Linux systems, let us know in the comments we’d love to hear about it.
What happens if the user that has sudo privileges suddenly changes profile and elevates to root profile? ie… ‘sudo su – ‘ at this point the user is in root profile /root . can this sysdig utility still monitor in this case?
@Jor
This is a good question, yes sysdig will still monitor the users activity. But it will show the user as root, this means as a system admin, you need to review logfiles(to be specific files in /var/log/audit/ or /var/log/auth.log) to see users who switched to root the account.
By default settings the bash_history is only written to when the shell is closed. Moreover starting your command line with a space doesn’t append it to the history. So using the bash history to monitor user activity looks like complete nonsense to me.
@K0n24d
~/.bash_history is only used to view previous commands as clearly stated in the article.
watch -n 1 tail ~/.bash_history
@TheOuterLinux
This will only help a user watch their own command history, as a sys admin, you would use something like:
#watch -n 1 tail /home/username/.bash_history
But this only allows you to watch one users commands history. Therefore, sysdig as shwon above is still more appropriate for keeping an eye on all users’ command line.