History

[mrg81]

Hi,

I am using a solaris machine , and of course there are many people who have logins on that machine. some how history seems to have been cleared automatically (I mean the history command doesnot show anything) . I checked the .bash_history file and the file just doesnot contain any thing.

I do remember typing history command prior to this event and it had showed me the list of commands that I had typed. Is there a way that history can automatically be cleared. I don't think rebooting the machine clears history . Is there a way to find out how was the history cleared.

Thanks in advance,

MRG.

[nihil]

Hi, it's been a few years since I played with a Solaris box. I would look at your history settings, I suspect that if the history file reaches the maximum that you chose, it will automatically clear itself. Now what I cannot remember is if it really "wipes" it or just archives it to another file.

Try Google for "Solaris" and "History" and "Archive"...................if that doesn't work PM me ........it is Sunday and I foolishly gave all the slaves who would know the answer the day off to worship

Errr..... like my mates won't be back at work until monday

What version of Solaris by the way?

[lumpyporridge]

You should be able to create a .logout file in your home dir with the a command to rm your .history, works for the c shell/tcsh and should for bash IIRC (maybe .bash_logout .bash_history), How it was cleared is a tough one and possibly impossible.

[zencoder]

mrg81 there are a couple of things to check.

Are you sure you're still using BASH? Has the SA implemented something different that may look/feel the same? Do you have permission to view the contents of .bash_history as a text file? The history command may show you things that grepping the file may not, depending on certain things, like a possible SetUID or others. Not certain, just a thought.

[IKnowNot]

I have never used solaris, but I would be VERY suspicious if my .bash_history file were empty on my Linux and Unix machines and I didn't delete the contents manually.

Who has rights to do it? Did they? Did you ask?

If I remember correctly ( the wine has kicked in ) the .bash_history file ( again, never worked with solaris ) doesn't archive when it reaches the pre-determined limit but appends to the end of the file dropping the first entries, kind of first-in first-out.

Ask the admin if they deleted it, if not, ask them to check to see if it has been possibly linked to a null device; a good clue that the box has been rooted.

[|gridley|]

You could try to check the following environment variables:
$HISTFILE (contains the path to the file in which the command history is stored)
$HISTSIZE (contains the amount of commands to keep (usually 500 or something))
(thus a 'echo $HISTFILE')

Also, if you have multiple sessions open, only the last one will actually save its commands in $HISTFILE (IIRC).
Furthermore, check the permissions to the $HISTFILE, they should be 600 (or -rw-------), not readable and especially not writeable by others.

Hope it helps, cheers