sudo su - root
Password:
~ root# osqueryi
I0809 12:09:06.350368 2952184640 options.cpp:63] Verbose logging enabled by config option
I0809 12:09:06.413350 2952184640 events.cpp:707] Subscriber expiration is too low: hardware_events
Using a virtual database. Need help, type '.help'
osquery> select * from shell_history;
W0809 12:09:11.895354 2952184640 virtual_table.cpp:516] The shell_history table returns data based on the current user by default, consider JOINing against the users table
W0809 12:09:11.895416 2952184640 virtual_table.cpp:531] Please see the table documentation: <https://osquery.io/docs/#shell_history>