View the history command and history command

View the history command and history command

Files have been cleared during production. Which of the following operations can be checked?

 

Use history to view historical commands:

$ History | more

 

You can also run the following command to view the history:

$ Vi ~ /. Bash_history

 

Only historical commands are displayed. For example, check who logged on to the system and executed these commands?

View User Login system information

$ Last

 

Run the following command:

$ Export HISTTIMEFORMAT = '% F % t' $ history | more

However, in this way, the command after HISTTIMEFORMAT is set will display the correct time, and the previous command will not display the correct time.

 

Confirm the command that causes the file content to be cleared. The similar content is as follows:

Lrwxrwxrwx. 1 root 6 Jul 22 wc-link.txt-> wc.txt

Ls is used to display detailed information, but the display result is accidentally used as a command for execution. The file is soft link and the redirection is executed. The result is that the file is cleared.

However, no final confirmation is made, because everyone uses the same user operation and is not associated with the IP address. What's your best solution?

 

Operate the linux terminal and use [Ctrl] + [R] To search for historical commands.