The command line is the place where most of the action takes place. When its a personal server, you can account for all actions that has been taken. When its a corporate server the actions can be taken by a number of people or teams. One way to see what is happening is to list the time and dates of all commands issued on the command line itself.
nano /root/.bashrc export HISTTIMEFORMAT="%Y-%m-%d %T "
The above code is to be added at the end of the file of /root/.bashrc once you have this you need to apply the settings with “source /root/.bashrc”. This will make the command line history show when the commands are executed.
A word of warning that this isn’t intended for audits on the server as commands can be issued via another method rather than directly from the command line.
firstname.lastname@example.org:~# history 1 2018-08-06 12:06:12 nano /root/.bashrc 2 2018-08-06 12:06:14 source /root/.bashrc 3 2018-08-06 12:06:15 history