Checking the history of www-data user

Question

While normal users have a .bash_history in their home directory, the www-data user does not have a home directory.

As such, are there any means to track the history of the www-data user?

Why would anyone be running bash as www-data in the first place? — Grant, Nov 17 '14 at 05:29
i was thinking along the lines of finding out which scripts / processes ran by www-data recently. mainly for diagnostic purposes. — Reuben L., Nov 17 '14 at 07:45
`.bash_history` is not a logfile. It is tool to aid interactive shells. The main purpose is that commands you have previously used in an interactive shell can be recalled in case you need to execute the same or a very similar command at a later time. — kasperd, Nov 17 '14 at 11:07

score 2 · Accepted Answer · answered Nov 17 '14 at 10:49

Process accounting could help your cause. If your kernel supports process accounting, which is something normally supported by kernels provided by distribution you need to enable process accounting by running

acct on

If you don't have acct you will need to install process accounting tools, e.g.

On centos/redhat

yum install psacct

On debian/ubuntu

apt-get install acct

and then to check what some user was running you can use

lastcomm www-data

Checking the history of www-data user

1 Answers1