Root complete history commands

Question

Where can I get root's history except besides .sh_history? I've gotten some information but only from .sh_history and the history command.

Solution

That's the only place you'll find it unless the system has auditing enabled. In which case, depending on how the auditing is setup, you'll get a detailed list of the commands that were run.

What gets logged when using auditing (auditd is the service you have to have installed) is a pretty broad question, I'd check out the documentation if you're interested in exploring that further.

• Chapter 30. Understanding Linux Audit

But again this is not typically enabled by default so you'd need to check with your admins of the system to see if it's enabled. If it isn't, then your only course of action to getting a history of the root user's history is from the history file that the shell maintains, typically /root/.bash_history if the account is setup to use Bash as the shell.