Part of forensic is to trace back what are the commands run by various users when then are on the system shell.

found this link which is pretty useful. how-to-log-all-bash-commands-by-all-users-on-a-server

Modifying the line to log to file instead of throwing to syslog.

[su_note]export PROMPT_COMMAND=’RETRN_VAL=$?;echo “$(date +%Y-%m-%d.%H%M%S) $(whoami) [$$]: $(history 1 | sed “s/^[ ][0-9]+[ ]//” ) [$RETRN_VAL]”>> ~/.bash-history-$(date “+%Y-%m-%d”).log'[/su_note]