On a few of my ubuntu installations, when I run sudo su and become sudo user, I can type history and view a list of commands run as sudo user. However, on my one ubuntu installation, for some reason when I run sudo su and type history, I just get this:

$ sudo su
# history
1  history 

But I know for certain that a lot of commands were run as sudo user, but when I ssh out and ssh back into my ubuntu server, they do not display, like how they do on the other servers. Do I have some switch or something disabled on this one server? How can I regain access to view the history of commands run as sudo user?


Some possibilities why you do not keep shell history:

  • Your root shell is not /bin/bash but /bin/sh (symlinked to /bin/dash). Change this with the chsh command.
  • The filesystem where /root resides is mounted read-only, so the history file cannot be written.
  • The variable HISTFILE is set to a value other than /root/.bash_history. An empty file disables history, other values are used as location to write the history to.
| improve this answer | |

history is what's known as a builtin. It's essentially a bash function that operates within your session (like the rest of the logging that feeds ~/.bash_history too).

When you run sudo something, that's happening within your session, not root's. Additionally, when something is run with sudo, it' doesn't spawn a separate bash session and then run the command. It's just executed with the correct privileges (I'm simplifying the truth somewhat).

This mildly undercuts Lekensteyn's different shell point. It's true, it just doesn't matter. Neither root bash or dash is the shell running the command. You can prove this by running something like sudo -u $USER whoami and then looking at ~/.bash_history. There is only one command. If this were another shell, I would expect to see sudo -u $USER whoami followed by whoami.

Also sudo su -c 'echo $0' outputs the parent shell (bash in my case) though I'm not sure if this is as significant.

Anyway, when you run sudo something it just goes into your own ~/.bash_history. If you want to see the command that you've run with sudo, run:

grep -E '^sudo' ~/.bash_history
| improve this answer | |
  • 2
    Exactly! The commands run as sudo are logged in the user's .bash_history i.e. /home/userName/.bash_history file and not in /root/.bash_history. Of course, if any commands were executed after sudo su or sudo -i, those would be logged in /root/.bash_history – precise Dec 4 '13 at 12:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.