In Linux, view User Login Operation Records

Article Title: in Linux, view User Logon Operation Records. Linux is a technology channel of the IT lab in China. Includes basic categories such as desktop applications, Linux system management, kernel research, embedded systems, and open source.

In a linux system, whether the root user or other users log on to the system and use the command history to view the historical records. However, if multiple users log on to a server, one day, someone accidentally deleted important data.

At this time, it makes no sense to view the history (command: history. Is there any way to record the IP address after login and the history of operations performed by a user name? Answer: Yes.

You can add the following code to/etc/profile:

PS1 = "'whoam' @ 'hostname':" '[$ PWD]'

History

USER_IP = 'Who-u am I 2>/dev/null | awk '{print $ NF}' | sed-e's/[()] // g''

If ["$ USER_IP" = ""]

Then

USER_IP = 'hostname'

Fi

If [! -D/tmp/dbasky]

Then

Mkdir/tmp/dbasky

Chmod 777/tmp/dbasky

Fi

If [! -D/tmp/dbasky/$ {LOGNAME}]

Then

Mkdir/tmp/dbasky/$ {LOGNAME}

Chmod 300/tmp/dbasky/$ {LOGNAME}

Fi

Export HISTSIZE = 4096

DT = 'date "% Y % m % d _ % H % M % S "'

Export HISTFILE = "/tmp/dbasky/$ {LOGNAME}/$ {USER_IP} dbasky. $ DT"

Chmod 600/tmp/dbasky/$ {LOGNAME}/* dbasky * 2>/dev/null

In fact, the above Code cannot tell you that it is very convenient to create a dbasky directory in/tmp of the system and record all users and IP addresses that have logged on to the system in the directory? We can also use this method to monitor system security.