1. Automox
  2. Using Automox
  3. Worklets & Scripting

How to View Bash History

Avatar
Jordan
Updated:

How to View Bash History

Bash keeps a record of commands entered in interactive shell sessions. On an Automox-managed Linux device this is most useful for establishing what a person did on the box, which is often what you need in order to rule the agent in or out when something changed unexpectedly.

Viewing history interactively

History is per user, so switch to the account whose history you want to see before running these.

Show the recorded history, which defaults to the last 500 commands:

history

Page through it:

history | less

Show just the last ten commands:

history | tail

Show the last 25 commands:

history 25

Each entry is numbered, and a command can be re-run by its number. Given entry 30 ls, run it again with:

!30

Reading the history file directly

History is also stored on disk in the user's home directory, which is how you read it without logging in as that user:

sudo cat /root/.bash_history
sudo cat /home/USERNAME/.bash_history

Two caveats when reading the file:

  • It is written when the shell exits. Commands from a session that is still open may not be in the file yet, so a live session's activity can be missing.
  • It records commands, not outcomes or timestamps. Unless HISTTIMEFORMAT is configured on the device, there is nothing in the file to tell you when a command ran, which limits how far it gets you in a timeline.

Reading history through a Worklet

This is where most attempts go wrong. history is a shell builtin that reads the history of the current interactive shell. A Worklet runs non-interactively, so calling history from a Worklet returns nothing and looks like an empty result rather than an error.

To collect history from a Worklet, read the files instead:

#!/bin/bash
for f in /root/.bash_history /home/*/.bash_history; do
    if [ -f "$f" ]; then
        echo "===== $f ====="
        tail -n 50 "$f"
    fi
done

Bound the output with tail rather than printing whole files, so the Activity Log stays readable.

Bash history is not where agent activity is recorded

If you are trying to establish what Automox did on a device, bash history is the wrong place to look. The agent executes commands directly rather than through an interactive login shell, so its activity is generally not written to .bash_history. An empty or unrelated history does not mean the agent was inactive.

For agent activity, use the agent's own log and the console:

Used together, these answer the question people usually have: the agent log and Activity Log show what Automox did, and bash history shows what someone did by hand.

Related articles

Articles in this section

See more
Was this article helpful?
0 out of 0 found this helpful