history

• How to make Linux History readonly
• Show IP address in history

To get history show time

echo 'export HISTTIMEFORMAT="%d/%m/%y %T "' >> ~/.bashrc
source  ~/.bashrc

history -a will append your current session history to the content of the history file.

history -w will replace the content of the history file with your current session history.

To remove the line number from history, run

history | sed 's|[0-9]\+\s\+||'

Or

history | cut -d' ' -f5-40

Log everything

To log everything, edit

vi /etc/bash.bashrc

Add

test "$(ps -ocommand= -p $PPID | awk '{print $1}')" == 'script' || (script -f $HOME/$(date +"%d-%b-%y_%H-%M-%S")_shell.log)

Or manually start logging in with

script -f $HOME/session.log

Method 2: Log Commands

edit /etc/profile

vi /etc/profile

At end of the file, add

export HISTTIMEFORMAT="%F %T "
PROMPT_COMMAND='echo "$(date +"%F %T") `whoami` from `who -u am i 2>/dev/null | awk "{print \$NF}" | tr -d "()"` ran `history 1 | sed "s/^[ ]*[0-9]\+[ ]*//"`" >> /var/log/commands.log'