copy .sh_history

[alan147]

Good morning

Is there a way I can make a duplicat copy of the .sh_history file as it is created. We have a user who is removing the file and I'm kind of curious to know what they are trying to hide.

Thanks

Alan

 

[petertp6]

If you are root , you can try this:
nohup tail -f user_.sh_history >> your_file &
Then you can see what he does by watch your_file,
But the user can also use ps to see this process,
So use it carefully.

 

[alan147]

Thanks very much.

Alan