Linux命令——history查看用户操作记录及时间

默认情况下Linux里使用history命令,只显示序列和命令,不含执行时间和执行用户:

image

修改/etc/profile文件,在末尾添加:export HISTTIMEFORMAT=”%F %T `whoami` ”

[[email protected] ~]# history | tail
  515  2011-09-08 15:34:46 root exit
  516  2011-09-08 15:34:02 root history | grep passwd
  517  2011-09-08 15:34:47 root exit
  518  2011-09-08 15:34:52 root su - marshall
  519  2011-09-08 15:58:45 root exit
  520  2011-09-08 16:02:12 root cat /etc/pro
  521  2011-09-08 16:02:15 root cat /etc/profile
  522  2011-09-08 16:02:24 root history
  523  2011-09-08 16:02:40 root history tail
  524  2011-09-08 16:02:45 root history | tail

因为某用户密码被修改,才想到了修改history命令的显示输出。可结合last命令查看谁在何时做了啥操作。

参考:http://www.itdhz.com/post-74.html

普人特福的博客cnzz&51la for wordpress,cnzz for wordpress,51la for wordpress