Also, keep in mind that for things like bash history file, the file is only written when the user's ssh session is closed, which means a persistent session will be missed, sometimes for days/weeks/months