Not sure if this is what you want, but try this...
watch -n 10 -d ls -l /root/.bash_history
This watch command will run every 10 seconds and display the differences in the bash history file that have occurred since the last run of this command.
However, you wont be able to ascertain which commands were executed by the various root sessions. It will simply tell you the commands that have been executed by user root. This will run real time.
CSR




Reply With Quote