How to get the commands issued in a ssh session

Question

I need to list out all the commands executed in a "ssh session". I use multiple ssh session to login to remote servers. So, when I logout from one session, I need to get the commands executed in that session.

Is there any option for that?

Solution

If you're running bash on the remote servers, it keeps history for you, and you can retrieve that history with the history command.

If you edit ~/.bash_profile to include the following line:

export HISTTIMEFORMAT="%h/%d -- %H:%M:%S "

your history will also have timestamps (to make it easier to figure what you ran in the current session, and what's ancient history).

As bash is shutting down, it will run your ~/.bash_logut script. If you make the last line of this script:

history

the last thing you'll have blurted at you as you're closing the connection will be your history - not just from the current session, unfortunately, but the timestamps should help you figure out which commands were from the current session and which were old.

If you don't mind losing history on the remote machines between sessions, you could add

unset HISTFILE

to your login scripts. When HISTFILE isn't set, bash won't save the history to a file. This will mean that the history that runs on logout can only show you the current session.

Comments

[Ярослав Рахматуллин]

No straight-forward, ready out-of-box solutions afaik because sshd is designed to hide communication between client and server. Similar question have been asked on this site previously. The shell does have a history though.

[peepeep]

I have seen such questions, but I haven't found a proper solution for this. That is the reason why I have posted this question. I think, a bash script will do..

[Kenster]

Maybe you're not asking the right question. What are you trying to accomplish, that you need this record for?

[peepeep]

Im using gnome-terminal and konsole. So the putty option is not what I want. I use the same terminal for logging into multiple ssh session one after the other. So, whenever I logout from one session, I need to get the printed list of the commands executed in that session.

[peepeep]

Thanks for the update. Till the .bash_logout is working fine for me. But, I didn't get the final part you have told, ie, not setting the history. I tried to add it in the .bashrc of my account, but didn't clear of any of the previous histories. So, its listing the old commands that I have executed few days back. Could you please explain how it is done??

[James Polley]

Right, unsetting HISTFILE won't clear out the old entries - the old entries are stored in a file, but since HISTFILE isn't set, bash doesn't know what that file is, so it can't clear it out. By default, that file is ~/.bash_history - you can rm that file yourself, or open it in a text editor and selectively trim it if you prefer.