Linux Logging user actions

上面脚本在系统的/var/log/.history下新建个history目录，记录所有登陆过系统的用户和IP地址（文件名），每当用户登录/退出会创建相应的文件，该文件保存这段用户登录时期内操作历史，可以用这个

Vim/etc/profile.d/history.SHuser_ip=`W.H.O.-U am I2>/dev/NULL|awk '{print $NF}'|sed-E's/[()]//g'' Histdir=/var/log/. Historydt=`Date+%y%m%d ' LogTime=`Date+%y%m%d_%h%m%S 'if[ -z $USER _ip] Thenuser_ip=`hostname`fiif[ ! -D $HISTDIR] Then  mkdir-P $HISTDIRchmod 777$HISTDIRfiif[!-D $HISTDIR/${logname}/${dt}/ ] Then  mkdir-P $HISTDIR/${logname}/${dt}/chmod  -$HISTDIR/${logname}fiif[!-F $HISTDIR/${logname}/${dt}/$USER _ip] Then  Touch$HISTDIR/${logname}/${dt}/$USER _ipchmod  -$HISTDIR/${logname}/${dt}/$USER _ipfiExport Histsize=4000Export Histtimeformat="%T"Export History_file="$HISTDIR/${logname}/$DT/${user_ip}"Export Prompt_command='{thishistid= ' history 1|awk ' {print \\$1} ', lastcommand= ' history 1| awk ' {\\$1=\ ' \ ';p rint} '; logtime=${whostr[4] };if [${thishistid}x! = ${lasthistid}x];then echo-e $lastCommand; lasthistid= $thisHistID;fi; } >> $HISTORY _file'Export histfile="$HISTDIR/${logname}/$DT/${user_ip}.${logtime}"

There is another scenario: this scheme sends every command executed by the user to the log daemon rsyslogd when each user exits the login, and you can further send the log to the log server by configuring "/etc/rsyslog.conf":

Here's what to do: Add the following to the/etc/profile file bottom [[email protected]-node1 ~]# vim/etc/profile.d/. History ... #设置history格式export Histtimeformat="[%y-%m-%d%h:%m:%s] [' Who am I 2>/dev/null| \awk '{print $NF}'|sed-E's/[()]//g'`]"#登录时清空当前缓存Echo "">. Bash_history #记录shell执行的每一条命令export Prompt_command='\if[-Z"$OLD _pwd"]; ThenExport Old_pwd=$PWD;fi;if[!-Z"$LAST _cmd"] && ["$ (History 1)"!="$LAST _cmd"]; ThenLogger-T 'WhoAmI' _shell_cmd"[$OLD _pwd]$ (History 1)";fi; export Last_cmd="$ (History 1)"; export Old_pwd= $PWD;'

Linux Logging user actions