How can I find the command history if a user used a space before the command?
There is no way to find out now. You probably have a setting in ~/.bashrc
that intentionally hides all commands prepending with a space from history. To change this behaviour in the future, you can edit ~/.bashrc
. Look for this line
HISTCONTROL=ignoredups:ignorespace
and change it to
HISTCONTROL=ignoredups