Detailed parsing of Linux user operation records

Linux user operation records can all be viewed using the command history, but if someone accidentally deletes important data, the Linux history command will basically not have much effect. How can we view the operation records of Linux users? Is there any way to record the operation history of IP addresses and user names after login? Answer: Yes.

You can add the following code to/etc/profile:

PS1 = "'whoam' @ 'hostname':" '[$ PWD]'

History

USER_IP = 'Who-u am I 2>/dev/null | awk '{print $ NF}' | sed-e's/[()] // g''

If ["$ USER_IP" = ""]

Then

USER_IP = 'hostname'

Fi

If [! -D/tmp/dbasky]

Then

Mkdir/tmp/dbasky

Chmod 777/tmp/dbasky

Fi

If [! -D/tmp/dbasky/$ {LOGNAME}]

Then

Mkdir/tmp/dbasky/$ {LOGNAME}

Chmod 300/tmp/dbasky/$ {LOGNAME}

Fi

Export HISTSIZE = 4096

DT = 'date "% Y % m % d _ % H % M % S "'

Export HISTFILE = "/tmp/dbasky/$ {LOGNAME}/$ {USER_IP} dbasky. $ DT"

Chmod 600/tmp/dbasky/$ {LOGNAME}/* dbasky * 2>/dev/null

In fact, the above Code cannot tell you that it is very convenient to create a dbasky directory in/tmp of the system and record all users and IP addresses that have logged on to the system in the directory? We can also use this method to monitor system security. This is another way to view Linux user operation records.

1. Differences between Linux and Unix
2. Detailed analysis of Linux Firewall Configuration
3. Detail Linux static IP configuration, DNS and host name 1)
4. Decrypts an important Linux system directory 1)
5. Linux OS in Hollywood replaces Microsoft