How to log and send executed commands to the server in Linux

Source: Internet
Author: User
Tags rsyslog

At work, we need to record every command that the user executes and send it to the log server, and I have done a simple solution. This scheme sends every command executed by the user to the log daemon rsyslogd every time the user exits the login, and you can further send the log to the log server by configuring "/etc/rsyslog.conf"

The first of these methods

The code is as follows:
# Vi/etc/profile
#设置history格式
Export histtimeformat= "[%y-%m-%d%h:%m:%s] [' Who am I 2>/dev/null| \
awk ' {print $NF} ' |sed-e ' s/[()]//g '] '
#记录shell执行的每一条命令
Export prompt_command= ' \
If [-Z "$OLD _pwd"];then
Export old_pwd= $PWD;
Fi
if [!-Z "$LAST _cmd"] && ["$ (History 1)"!= "$LAST _cmd"]; Then
Logger-t ' WhoAmI ' _shell_cmd "[$OLD _pwd]$ (History 1)";
fi;
Export last_cmd= "$ (History 1)";
Export old_pwd= $PWD; '

The second method
The first step: Global Settings (this is a one-time setting, requires root user privileges)

The code is as follows:
# Vi/etc/profile
#用户登录时执行此脚本
#设置history显示格式
Export histtimeformat= "[%y-%m-%d%h:%m:%s] [' Who Am I 2>/dev/null\
| awk ' {print $NF} ' |sed-e ' s/[()]//g '] '
#登录时清空当前缓存 echo "" > Bash_history

Step two: Different users are set up separately

The code is as follows:
# Source/etc/profile
# Vi/home/user1/.bash_logout
#当用户退出登录时会执行此脚本
tmpfile= "/tmp/' WhoAmI ' _history.tmp"
#把格式化的history记录到文件里
History > $tmpfile
#读取文件, a line to send the contents of the file to the SYSLOGD.
#不要试图用 "History | Logger "or" logger-f $tmpfile "instead of the following code,
#否则将只能记录前200行.
K=1
while read line; Todo
((k++))
Logger-t ' WhoAmI ' _shell_cmd "$line"
Done < $tmpfile
Rm-f $tmpfile

(Repeat the second step if there are other users who need to be monitored)
Step three: Send the log to the remote host (optional)

The code is as follows:
# vi/etc/rsyslog.conf
#增加如下行, IP Exchange, can also use the domain name, @ indicated by the UDP protocol, @@ 表示 with the TCP protocol
*.* @192.168.0.1

Deficiencies:
1. Cannot record commands in real time and send log
2. To log the commands under the Terminal desktop requires a reboot.
=========

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.