Looking at .sh_history file.

UNIX AIX
1

I reviewed a couple old post where shockneck posted the use of the

EXTENDED_HISTORY=ON

variable to place a timestamp in the .sh_history file when using ksh and using the

fc -t

command to read the .sh_history file.

The fc command reads my history file. As an admin I would like to be able to read other users .sh_history file. In the past I have just copied it to a tmp location and read the file with my favorite editor. From what I can gather the timestamp is encrypted somehow so that I can't read it with a normal vi session.

ls -al /.sh_history #�#1303480405#�#
ls -al #�#1303480411#�#

Output using the fc command:

1113    2011/04/22 08:53:25 :: ls -al /.sh_history
1114    2011/04/22 08:53:31 :: ls -al

Is there a command out there that I can read the .sh_history file of other users and still be able to see the timestamp info?

If I am missing something obvious in the fc man page please just correct me.

Thanks.

2

It doesn't look encrypted as such. That's the time in epoch seconds(1303480405 amounts to Fri Apr 22 07:53:25 CST 2011 in my timezone). I think it's just surrounded with that strange gobbedlygook to guarantee to ksh that it's looking at its OWN timestamps and not just some random comment that you typed into the shell by hand.

If you had GNU date getting real timestamps from epoch timestamps would be easy, but on AIX you might need to resort to perl.

#!/usr/bin/perl

while($line=<STDIN>)
{
        if($line =~ /^([^#]+)#...#([0-9]+)#...#\n/)
        {
                printf("%s\t%s\n", $1, localtime($2));
        }
        else
                print $line;
}

I wish I could test that regex, but that string is so weird it turns into nothing but ??????? when I copy-paste it.

3

Right you are Corona688. Ok, easily decoded with a little scripting.

Anyone with knowledge of a command to just read the history file of another user without decoding please pass it along.

Thanks.

4

how about cat?

5

Maybe I misspoke, I meant read the history file of another user and the decoded timestamp be displayed rather than the epoch time as cat output looks just like the vi output.

ls -al /.sh_history #�#1303480405#�#
ls -al #�#1303480411#�#

For some reason I completely over looked your perl code above. I think I just read the email notice that came in and it didn't include all of your reply. Not a great coder but will see what I can make work.

Thanks again.

6

I have a bad habit of editing my replies after I post them.

See?