Syslog Records history

Record history to syslog and transmit it to the remote log collection server in real time.

Method: use the new function bash4.1: Save History commands to syslog! Then, use syslog-ng to build a concentrated log server to collect host logs.

1. Download Bash:

# Wget http://ftp.gnu.org/gnu/bash/bash-4.1.tar.gz
# Tar zxvf bash-4.1.tar.gz-C/tmp/bash-4.1
# Cd/tmp/ bash-4.1

2. modify source code

(According to my personal needs, I only keep the PID, uid, Sid, etc. For the parameters, see Shell. C in the directory ):
The bashhist. c file starts at the location of approximately 708 rows and is changed to the following section:

1	syslog (SYSLOG_FACILITY|SYSLOG_LEVEL, "HISTORY: PID=%d PPID=%d SID=%d  User=%s CMD=%s", getpid(), getppid(), getsid(getpid()),  current_user.user_name, line);

2

else

3

{

4	strncpy (trunc, line, SYSLOG_MAXLEN);

5	trunc[SYSLOG_MAXLEN - 1] = '\0';

6	syslog (SYSLOG_FACILITY|SYSLOG_LEVEL, "HISTORY (TRUNCATED): PID=%d  PPID=%d SID=%d User=%s CMD=%s", getpid(), getppid(), getsid(getpid()),  current_user.user_name, trunc);

7

}

Note:
Ppid: the user who follows the sh Switch
Sid: the user who follows su Switching
The second segment indicates the statement used when the log length exceeds 600.
Modify config-top.h files

1	/*#define SYSLOG_HISTORY*/

2

Change

3	#define SYSLOG_HISTORY

Compile and install
#./Configure-Prefix =/usr/local/bash_4.1 & make install
Modify user configuration:
Replace the user's bash with the current bash4.1
# Vi/etc/passwd
Linkboy: X: 501: 501:/home/linkboy:/usr/local/bash_4.1/bin/bash
In this way, logs are recorded in/var/log/messages.
The result is similar to the following:

Dec 23 17:40:28 server-Bash: History: pid = 4089 ppid = 4088 SID = 4089 user = linkboy cmd = exit
Dec 23 17:41:47 server-Bash: History: pid = 4282 ppid = 4278 SID = 4282 user = root cmd = exit

......
The record function is configured throughout the environment to easily find out who-when, what account to use, what operations to perform...

3. Host syslog configuration (add the address of the log server)

# Vi/etc/syslog. conf

Add the last column:

1	*.* @syslog.com