Maybe you know this problem, if more than one user has root access to a server you have very little chances to control who was it. The only hook could be date and time. Default if you issue the “history” command you see a command number and the operation.

Put the next line in your .bashrc and you will see date and time in your history:

1
2

# Bash Timestamps
export HISTTIMEFORMAT="%F %T "

Finely to make it work execute:

1

source .bashrc

Your new history format:

1
2
3
4
5

536  2011-05-31 22:06:44 less /var/log/syslog
537  2011-05-31 22:06:46 ll
538  2011-05-31 22:06:54 vim rssh.pl
539  2011-05-31 22:07:07 perl rssh.pl
540  2011-05-31 22:07:16 ss -lnp