Check and make sure that the HISTFILE is not set to /dev/null or something in your .profile. If it is not set at all in there, then bash should default to ~/.bash_hsitory. Also, make sure that HISTFILESIZE and HISTSIZE are not set to 0. HISTFILESIZE will limit how big that file can get, while HISTSIZE will limit the number of entries in the file. If any of these have been set in your .profile, then that would be cause for concern as intruders will set these so that their commands are not logged.
<br><br><div><span class="gmail_quote">On 10/1/05, <b class="gmail_sendername">Kevin C. Smith</b> <<a href="mailto:kevin@linuxsmith.com">kevin@linuxsmith.com</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
Anyone know why this would happen?<br><br>chkrootkit report:<br>Warning: `//root/.bash_history' file size is zero<br><br>The file time stamp is the same time I rebooted<br>the server. Can this happen on reboot? Seems odd.
<br><br>I can't find any other evidence to compromise, so ..<br><br><br>--<br>Kevin C. Smith<br><br>_______________________________________________<br>Cialug mailing list<br><a href="mailto:Cialug@cialug.org">Cialug@cialug.org
</a><br><a href="http://cialug.org/mailman/listinfo/cialug">http://cialug.org/mailman/listinfo/cialug</a><br></blockquote></div><br>