sh_history file

UNIX for Advanced & Expert Users
1

Hi,

I'm on a linux machine. But I see that sh_history is not updated since february 15. How is it possible ?

Thank you.


uname -a
Linux MYSERVER 2.6.18-194.11.3.el5PAE #1 SMP Mon Aug 23 15:57:10 EDT 2010 i686 i686 i386 GNU/Linux

ls -al
-rw-------  1 oracle dba    3644 f�v 15 09:28 .sh_history
2

.sh_history is only used by the kornshell. Does "oracle" use a different shell?

You could also check the environment variable $HISTFILE. Maybe it points to a different file?

3

thank you
>echo $HISTFILE

$HISTFILE is empty. On the other servers .sh_history is used by oracle user.

even bash_history is not updated.

>ls -al
total 1084
drwx------  5 oracle dba    4096 jui  5 09:49 .
drwxr-xr-x 19 root   root   4096 mai 10 11:12 ..
-rw-------  1 oracle dba    2453 d�c 28  2009 .bash_history
-rw-r--r--  1 oracle dba      24 mai  6  2008 .bash_logout
-rw-r--r--  1 oracle dba     191 mai  6  2008 .bash_profile
4

What does

getent passwd oracle

say? The last field in the output is oracle's shell.

5

It says :


getent passwd oracle
oracle:x:75:104:Admin Oracle:/home/oracle:/bin/ksh
6

Hmm, /bin/ksh is ok. Then the last thing I can think of is, that somewhere in the startup sequence of oracle's shell (like .profile /etc/profile, ...) a different shell is exec'd and the user works with this shell instead of the login-shell.

7

ok, thank you.
How to detect/rectify that ?
How to find the histfile on which oracle commandes are registered ?

Regards.

8

The kornshell includes /etc/profile and ~/.profile at startup and also the file identified by $ENV, if set. Check these files if they execute shells or other scripts that may execute shells.

The history file is set in the $HISTFILE variable. This variable is not set in your case, so the default is ~/.sh_history.

9

can you write output of this..

# grep exec /etc/profile -a2

if you see like `exec bash`
you can view hist commands

# echo "$(<$(awk -F: '$1 == "oracle" {print $6}' /etc/passwd)/.bash_history)"

regards
ygemici

10

yes

echo "$(<$(awk -F: '$1 == "oracle" {print $6}' /etc/passwd)/.bash_history)"

seems working but not sure if it displays all of bash_history;

Thanks anyway.

11

What you do not say is "How" does the user oracle connects himself...(telnet, ssh... or as a user then su (without -)).
On all unix systems ther is a command called last...If this one says last connection for oracle is in Feb then it may be that all is fine and normal...