June 26th, 2005, 06:54 AM
I am using a solaris machine , and of course there are many people who have logins on that machine. some how history seems to have been cleared automatically (I mean the history command doesnot show anything) . I checked the .bash_history file and the file just doesnot contain any thing.
I do remember typing history command prior to this event and it had showed me the list of commands that I had typed. Is there a way that history can automatically be cleared. I don't think rebooting the machine clears history . Is there a way to find out how was the history cleared.
Thanks in advance,
June 26th, 2005, 11:32 AM
Hi, it's been a few years since I played with a Solaris box. I would look at your history settings, I suspect that if the history file reaches the maximum that you chose, it will automatically clear itself. Now what I cannot remember is if it really "wipes" it or just archives it to another file.
Try Google for "Solaris" and "History" and "Archive"...................if that doesn't work PM me ........it is Sunday and I foolishly gave all the slaves who would know the answer the day off to worship
Errr..... like my mates won't be back at work until monday
What version of Solaris by the way?
June 26th, 2005, 11:24 PM
You should be able to create a .logout file in your home dir with the a command to rm your .history, works for the c shell/tcsh and should for bash IIRC (maybe .bash_logout .bash_history), How it was cleared is a tough one and possibly impossible.
Do unto others as you would have them do unto you.
The international ban against torturing prisoners of war does not necessarily apply to suspects detained in America\'s war on terror, Attorney General John Ashcroft told a Senate oversight committee
-- true colors revealed, a brown shirt and jackboots
June 27th, 2005, 01:48 AM
mrg81 there are a couple of things to check.
Are you sure you're still using BASH? Has the SA implemented something different that may look/feel the same? Do you have permission to view the contents of .bash_history as a text file? The history command may show you things that grepping the file may not, depending on certain things, like a possible SetUID or others. Not certain, just a thought.
"Data is not necessarily information. Information does not necessarily lead to knowledge. And knowledge is not always sufficient to discover truth and breed wisdom." --Spaf
Anyone who is capable of getting themselves made president should on no account be allowed to do the job. --Douglas Adams (1952-2001)
"...people find it far easier to forgive others for being wrong than being right." - Albus Percival Wulfric Brian Dumbledore
June 27th, 2005, 11:36 AM
I have never used solaris, but I would be VERY suspicious if my .bash_history file were empty on my Linux and Unix machines and I didn't delete the contents manually.
Who has rights to do it? Did they? Did you ask?
If I remember correctly ( the wine has kicked in ) the .bash_history file ( again, never worked with solaris ) doesn't archive when it reaches the pre-determined limit but appends to the end of the file dropping the first entries, kind of first-in first-out.
Ask the admin if they deleted it, if not, ask them to check to see if it has been possibly linked to a null device; a good clue that the box has been rooted.
" And maddest of all, to see life as it is and not as it should be" --Miguel Cervantes
June 30th, 2005, 10:54 AM
You could try to check the following environment variables:
$HISTFILE (contains the path to the file in which the command history is stored)
$HISTSIZE (contains the amount of commands to keep (usually 500 or something))
(thus a 'echo $HISTFILE')
Also, if you have multiple sessions open, only the last one will actually save its commands in $HISTFILE (IIRC).
Furthermore, check the permissions to the $HISTFILE, they should be 600 (or -rw-------), not readable and especially not writeable by others.
Hope it helps, cheers