I've done some research and it looks like that the way linux keeps history is less about security and audit and more about helping the user.

Even after making changes to instantly log the command and space commands the command still wont log till finished.

Is there any way to improve audit logging other then possibly writing a module for the linux kernel that will instantly log whatever is typed?


You can also daemonize a user-space keylogger and have it log anything for any user. There are many available on github.


We use a Privileged Access Management (PAM) program to handle access control. Not only will it control who can run ssh remote commands, but it will also log it immediately... who ran what command on what host an when.

  • We try not to promote any specific vendor unless they uniquely answer the question. There are many different PAM vendors that perform the function you speak of, so there is no need to call out this one particular vendor.
    – schroeder
    Sep 15 '20 at 9:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.