tail -2 /root/.bashrcexport HISTTIMEFORMAT=%d/%m/%y %T export PROMPT_COMMAND='builtin history 1 >> /var/log/root.log' With this all the commands could be logged (even the ones that were in sudo su - ). My question: How can I put username info in the history file, so not just the time will be logged, but the original user, who sudo su -'ed username is in the history files too (or process PID from it's shell, or any unique identifier)?
How to format history file to contain username too?
bashrc
When you start a root bash shell as sudo -i or sudo -s or sudo su (provided root's login shell is bash) or sudo bash, the original user is available as $SUDO_USER.But when started as sudo su -, the environment is cleared by su, so you'll have to find another way to find the original user.One way, if you've got the pstree command could be:original_user=${SUDO_USER:-$(pstree -Alsu $$ |  sed -n s/.*(\([^)]*\)).*($USER)[^(]*$/\1/p)}export HISTTIMEFORMAT=<%F %T> (${original_user:-$USER}) [$$] export PROMPT_COMMAND='builtin history 1 >> /var/log/root.log'The idea being to parse the output of pstree -Alsu $$ which looks like:init---xterm(user)---zsh---sudo(root)---su---bash---pstreeTo extract the user.