How to view the operation record after user login under Linux

  
 

In the Linux system environment, whether it is the root user or other users, only after logging in to the system, we can use the history to view the history, but if one server logs in, one day is because someone is wrong. The operation deleted important data. It doesn't make sense to look at the history (command: history) at this time. Is there any way to achieve a history of operating the IP address and a username after logging in? Answer: Yes. This can be done by adding the following code to /etc/profile: PS1="`whoami`@`hostname`:"'[$PWD]'historyUSER_IP=`who -u am i 2>/dev/null

Copyright © Windows knowledge All Rights Reserved