Where I work, for security and auditing purpose, we have to keep one history file for each session (user, date, terminal, etc in the file name).Obviously, the HISTFILE variable, is set to read only (readonly HISTFILE), therefore a normal user cannot set a different history file (either not root, without changing /etc/profile).This is what we have in the /etc/profile:EXTENDED_HISTORY=ONreadonly EXTENDED_HISTORYexport EXTENDED_HISTORYHISTFILE=$HOME/.history/`date +%y%m%d.%H%M%S`.${WHO_USER:-user}.${WHO_TERMINAL:-term}.${SSH_PORT:-port}.${MY_PID:-pid}readonly HISTFILEexport HISTFILEThe big issue is that we cannot search for old commands, except doing a grep on the older files.Do you please have a simple workaround or even a better solution to keep the auditing and still be able to share the command history across multiple sessions?We use ksh and bash.
Shell - Deal with multiple command history files
bash;command history;ksh
Shell history files are a poor way of auditing commands. They can trivially be modified or bypassed by users. They are only useful if you trust users not to deliberately or accidentally bypass the auditing mechanism. For example, commands started from a GUI, from an editor, etc. aren't recorded this way. There are many other ways a user could launch non-logged commands and even maintain plausible deniability that they were doing it for convenience or without realizing it and not as a deliberate attempt to bypass a security measure.If you make the history files append-only (which requires running chattr +a as root on the history file), then everything that's been recorded stays recorded, but it's still easy to bypass the recording.Rather than keep separate history files, you could keep a single history file and back it up regularly. That will retain the date at which commands were executed, but not the terminal.If you need to have some confidence that the logs correspond to the commands that were executed, shell history files are the wrong tool. Use the audit daemon instead. Configure it to log all execve calls.auditctl -A exit,always -S execveSee the following questions for more information:Log every invocation of every SUID program?Process Monitor equivalent for Linux?Can I send auditd logs to another computer?