|
-- Retrieves the command history, per user, by parsing the shell history files.
|
|
--
|
|
-- interval: 86400
|
|
-- platform: posix
|
|
-- value: Identify actions taken. Useful for compromised hosts.
|
|
-- version: 1.4.5
|
|
|
|
select * from users join shell_history using (uid);
|