# How to have an array that pulls up linux commands **URL:** \ **Category:** Kibana\ **Created:** [April 17, 2023, 10:45am UTC](https://discuss.elastic.co/t/how-to-have-an-array-that-pulls-up-linux-commands/330116 "2023-04-17T10:45:44Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Wad1636](https://avatars.discourse-cdn.com/v4/letter/w/3ab097/32.png) [@Wad1636](https://discuss.elastic.co/u/Wad1636)\ **Post date:** [April 17, 2023, 10:45am UTC](https://discuss.elastic.co/t/how-to-have-an-array-that-pulls-up-linux-commands/330116/1 "2023-04-17T10:45:44Z")
Good morning, I would like to have a reassembly of the commands type on linux live and put them in a table, the problem I can't already find how to reassemble the commands. Thanks for your future help. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [April 17, 2023, 9:31pm UTC](https://discuss.elastic.co/t/how-to-have-an-array-that-pulls-up-linux-commands/330116/2 "2023-04-17T21:31:08Z")
Welcome to our community! 😃 It's not really clear what you are referring to here, are you able to add more information? ---
**Author:** ![Wad1636](https://avatars.discourse-cdn.com/v4/letter/w/3ab097/32.png) [@Wad1636](https://discuss.elastic.co/u/Wad1636)\ **Post date:** [April 18, 2023, 8:10am UTC](https://discuss.elastic.co/t/how-to-have-an-array-that-pulls-up-linux-commands/330116/3 "2023-04-18T08:10:40Z")
yes of course, I would like to have a reassembled of the "bash\_history" or similar to have on my kibana a dashboard where we see the commands type on the linux server ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [April 19, 2023, 2:13am UTC](https://discuss.elastic.co/t/how-to-have-an-array-that-pulls-up-linux-commands/330116/4 "2023-04-19T02:13:15Z")
You could use [Auditd module | Filebeat Reference [8.7] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-auditd.html) or [Auditbeat Reference [8.7] | Elastic](https://www.elastic.co/guide/en/beats/auditbeat/current/index.html) for that. ---
**Author:** ![Wad1636](https://avatars.discourse-cdn.com/v4/letter/w/3ab097/32.png) [@Wad1636](https://discuss.elastic.co/u/Wad1636)\ **Post date:** [April 19, 2023, 2:40pm UTC](https://discuss.elastic.co/t/how-to-have-an-array-that-pulls-up-linux-commands/330116/5 "2023-04-19T14:40:14Z")
yes I had already taken note of his tools, but I have a little advanced on my side and I have a start but not what I want either I configured auditd with this config: -a always,exit -F arch=b32 -S execve -a always,exit -F arch=b64 -S execve and by processing it I get this: ![Capture d’écran 2023-04-19 163824](https://us1.discourse-cdn.com/elastic/original/3X/a/1/a11b0b18ade25a332ee7eecd2b06143e5f726065.png) but I would like a result that comes closest to "bash\_history", if you have any ideas ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [April 19, 2023, 9:25pm UTC](https://discuss.elastic.co/t/how-to-have-an-array-that-pulls-up-linux-commands/330116/6 "2023-04-19T21:25:52Z")
The only other way I could think would be to use Filebeat and monitor every instance of the `.bash_history` file you can find. ---
**Author:** ![Wad1636](https://avatars.discourse-cdn.com/v4/letter/w/3ab097/32.png) [@Wad1636](https://discuss.elastic.co/u/Wad1636)\ **Post date:** [April 21, 2023, 1:06pm UTC](https://discuss.elastic.co/t/how-to-have-an-array-that-pulls-up-linux-commands/330116/7 "2023-04-21T13:06:34Z")
I found a solution, I add this command line > PROMPT\_COMMAND='history -a \>(logger -t "bash\_history[$USER]")' in the bashrc, this command allows to transfer each command in the syslog then I recover with filebeat. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 19, 2023, 1:07pm UTC](https://discuss.elastic.co/t/how-to-have-an-array-that-pulls-up-linux-commands/330116/8 "2023-05-19T13:07:23Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.