history
is a bash shell builtin command, and sudo
doesn't work with shell builtins.
What's a builtin command and what's not?
I used the command which
that "returns the pathnames of the files (or links) which would be executed in the environment" to confirm that history
was not an external (to bash) command.
For example, running
$ which history
$
returns nothing and the exit code is 1 (one or more specified commands is nonexistent or not executable) [FYI see the exit code with echo $?
], while running
$ which ls
/bin/ls
$
and the exit code 0 (all specified commands are found and executable).
Also, in bash you can look up help for builtin commands with help
(or searching the man bash
page). For example, typing
$ help history
history: history [-c] [-d offset] [n] or history -anrw [filename] or history -ps
arg [arg...]
Display or manipulate the history list.
...
shows bash's help info. Running help non-bash-command
returns something similar to this:
$ help ls
bash: help: no help topics match `ls'. Try `help help' or `man -k ls' or
`info ls'.
and the exit code 1
So what has sudo been doing?
You can search your own history for sudo
commands your user has run (and not skipped saving it to history) with grep '^sudo' .bash_history
or history|less
or similar.
Or, on Ubuntu the file /var/log/auth.log
keeps records of what sudo
has been doing for all users, search for "sudo" in there (other distros may use the file /var/log/secure
), or could use
sudo grep sudo /var/log/auth.log
or run sudo journalctl _COMM=sudo
if you've got systemd.
See the question "Details about sudo commands executed by all user" on Unix & Linux for more details
history
is a bash shell builtin command. There may be other logs recording what sudo has been up to