Skip to main content

How to view the changes made by a cPanel Support Analyst or Engineer via the command line

Austin Lowery
  • Updated

Introduction


Whenever access is granted to cPanel support through a ticket, our automated ticket system is used to initiate an SSH session with the server. As a part of the automated process of initiating the SSH session, our system will ensure that all of the commands that an Analyst or Engineer runs will be saved to a history file of a specific name within the root user's home directory. You may use the following command to view the bash history of one of our Analysts or Engineers to see what actions were taken on your server via SSH. This can be a great way to learn more about what kinds of commands and scripts analysts use to troubleshoot issues. This can also serve as a way to audit changes if you want to know if a particular change was performed by an analyst while they were logged into your server.

 

Procedure

 

Method  #1: Viewing the Raw Bash History Files

  1. Login to the server via SSH or Terminal as the root user
  2. Issue the following command to list all of the bash history files for the analysts that have worked on the server: 
    ls -lah /root/.bash_history.cpanel_ticket*
    NOTE: You'll notice that each history file contains the ticket ID that it is associated with in the filename.
  3. Use the less command to view the file of your choice

 

Method  #2: Use an Awk command to format the files into a human readable format:

  1. Login to the server via SSH or Terminal as the root user
  2. Issue the following command to list all of the bash history files for the analysts that have worked on the server: 
    ls -lah /root/.bash_history.cpanel_ticket*
    NOTE: You'll notice that each history file contains the ticket ID that it is associated with in the filename.
  3. Use the following command to format the file of your choice. Be sure to replace FILENAME at  the end of the command with the history file you would like to view: 
    awk -F\# '/^#1[0-9]{9}$/ { if(cmd) printf "%s %s\n",ts,cmd; ts=strftime("%F %T",$2); cmd="" } !/^#1[0-9]{9}$/ { if(cmd)cmd=cmd "\n" $0; else cmd=$0 }' FILENAME

     

Method #3  Use a script to automate the process of finding and formatting the files

  1. Login to the server via SSH or Terminal as the root user
  2. Create the script file with the following command: 
    touch /root/cPanelBashHistoryTool.sh
  3. Make the file executable: 
    chmod +x /root/cPanelBashHistoryTool.sh
  4. Open the file with the text editor of your choice
  5. Copy the below script  into the file: 
    #!/bin/bash

    RED='\033[0;31m'
    NC='\033[0m'

    echo
    find /root/ -type f -name ".bash_history.cpanel_ticket*" | grep -v "humanreadable" |
    while read histpath
    do
    echo
    ticketID=$(echo $histpath | sed 's/\/root\/.bash_history.cpanel_ticket.//')
    humanReadable="$histpath-humanreadable"
    printf "${RED}FOUND${NC}: %s\n" $histpath
    printf "${RED}TicketID${NC}: %s\n" $ticketID
    echo "Generating Human Readable Version..."
    awk -F\# '/^#1[0-9]{9}$/ { if(cmd) printf "%s %s\n",ts,cmd; ts=strftime("%F %T",$2); cmd="" } !/^#1[0-9]{9}$/ { if(cmd)cmd=cmd "\n" $0; else cmd=$0 }' $histpath > $humanReadable
    printf "${RED}HumanReadablePath${NC}: %s\n" $humanReadable
    echo "Use the following command to view the human readable version:"
    echo "less $humanReadable"
    done
    echo
    echo "Script Finshed."

     

  6. Run the script and then review the output to see the paths to the human readable files that were generated: 
    bash /root/cPanelBashHistoryTool.sh

Related articles