Adding timestamp and user to bash history
<p>I want to add the timestamp and user, who executed the command to my history command. Is this even possible?</p>

<p>By adding this line to the ~/.bashrc, you're able to add the timestamps to the history command:</p>

<pre><code>    HISTTIMEFORMAT="[ %Y/%m/%d %T ] "
</code></pre>

<p>This results in something like this by running <em>history</em>:</p>

<pre><code>     1841  [ 2016/08/25 10:57:54 ] ls
     1842  [ 2016/08/25 10:57:56 ] who
     1843  [ 2016/08/25 10:57:59 ] last
     1844  [ 2016/08/25 10:58:10 ] uptime
     1845  [ 2016/08/25 10:58:13 ] history
</code></pre>

<p>Now, I want an additional info: Which real user has executed these commands?</p>

<p>Yes, the history is saved and written for each individual user to the $HISTFILE (~/.bash_history), but usually has every user his own login like "firstname-name" or anything else.</p>

<p>An example user called "max-mustermann" logs in via SSH and switches to the user "root" for example. The user "max-mustermann" is now acting as "root".</p>

<p>I want to log the "real" user (in this case "max-mustermann") and maybe some additional information like the used IP address, to be able to identify, who has executed the command "uptime" as user "root". I thought, I've found a solution, but it didn't really work. Add the following lines to your ~/.bashrc to test it:</p>

<pre><code>    TTY_CON=$(tty | cut -d '/' -f 3-);
    HIST_WHO_INFO=$(who | grep "${TTY_CON}" | cut -d ' ' -f 1,12);
    HISTTIMEFORMAT="[ %Y/%m/%d %T by ${HIST_WHO_INFO} ] "
</code></pre>

<p>This returns something like this:</p>

<pre><code>     1848  [ 2016/08/25 11:06:47 by max-mustermann (10.50.1.42:S.0) ] ls
     1849  [ 2016/08/25 11:06:48 by max-mustermann (10.50.1.42:S.0) ] who
     1850  [ 2016/08/25 11:06:49 by max-mustermann (10.50.1.42:S.0) ] last
     1851  [ 2016/08/25 11:06:51 by max-mustermann (10.50.1.42:S.0) ] uptime
     1852  [ 2016/08/25 11:06:52 by max-mustermann (10.50.1.42:S.0) ] history
</code></pre>

<p>That's perfect, but unfortunately, it doesn't keep / save the real user with the history. If somebody else logs in, all commands, which were executed as user "max-mustermann" in this example would get updated to the new user, who has logged in:</p>

<pre><code>     1848  [ 2016/08/25 11:06:47 by somebody-else (10.50.1.18) ] ls
     1849  [ 2016/08/25 11:06:48 by somebody-else (10.50.1.18) ] who
     1850  [ 2016/08/25 11:06:49 by somebody-else (10.50.1.18) ] last
     1851  [ 2016/08/25 11:06:51 by somebody-else (10.50.1.18) ] uptime
     1852  [ 2016/08/25 11:06:52 by somebody-else (10.50.1.18) ] history
     1853  [ 2016/08/25 11:08:13 by somebody-else (10.50.1.18) ] history
</code></pre>

<p>How can I solve this problem?</p>