Log records of each command executed by Linux users (history)

At work, we need to record every command executed by the user and send it to the log server, so I have made a simple solution. This scheme sends every command executed by the user to the log daemon rsyslogd when each user exits the login, and you can further send the log to the log server by configuring "Etcrsyslog.conf"

The first of these methods

#vi Etcprofile

# set The history format

exporthisttimeformat=[%y-%m-%d%h%m%s] [' Who Am I 2devnull

awk ' {print $NF} ' sed-e ' s[()]g ']

# record each command executed by the shell

Exportprompt_command= '

If[-Z $OLD _pwd];then

Export old_pwd= $PWD;

Fi

if[!-Z $LAST _cmd] && [$ (history 1)! = $LAST _cmd]; Then

Logger-t ' WhoAmI ' _shell_cmd[$OLD _pwd]$ (history 1);

Fi

exportlast_cmd=$ (history 1);

exportold_pwd= $PWD; '

The second method of

The first step : Global Settings (This is a one-time setting and requires root user rights)

#vi Etcprofile

# execute this script when the user logs on

# set the history display format

exporthisttimeformat=[%y-%m-%d%h%m%s] [' Who Am I 2devnull

awk ' {print $NF} ' sed-e ' s[()]g ']

# empty the current cache at login Echo. bash_history

Step Two: Different users set up separately

#source Etcprofile

#vi Homeuser1.bash_logout

# This script is executed when the user exits the login

Tmpfile=tmp ' WhoAmI ' _history.tmp

# record the formatted history into a file

History $tmpfile

# read the file, one line to send the contents of the file to the SYSLOGD.

# do not attempt to replace the following code with the history logger or logger-f$tmpfile

# Otherwise, only the first 200 rows will be recorded.

K=1

Whileread Line; Do

((k++))

Logger-t ' WhoAmI ' _shell_cmd $line

Done $tmpfile

Rm-f $tmpfile

( Repeat the second step if there are other users who need to monitor)

Step three : Sends the log to the remote host (optional)

#vi etcrsyslog.conf

 # Add the following line, IP, or you can use the domain name, @ for the UDP protocol, @@ 表示 with the TCP protocol

. @192.168.0.1

Deficiencies:

1. cannot log command and send log in real time

2. to record the command under the Terminal desktop requires a reboot.

brother Lian education original OPS engineer http:// www.lampbrother.net/linux/

learn PHP, Linux, HTML5, UI, Android and other video tutorials (Courseware + notes + video)! Contact Q2430675018

Brother even the Linux classroom video, collect contact Q2430675018

Log records of each command executed by Linux users (history)