Using Rsyslog to audit Linux operations

Environment: Both the client and the server need to install the Rsyslog service

Rsyslog Server Side

Cd/etc/rsyslog.d/cat server.conf$modload Imtcp$inputtcpserverrun 514 vim/etc/rsyslog.conflocal4.* /var/log/history.log

Rsyslog Client Side

cat/etc/rsyslog.d/client.conflocal4.* @ @server End ip:514

Cat/etc/profile.d/client.shexport prompt_command= ' {msg=$ (History 1 | {read x y; echo $y;}); Logger-p local4.info ["local| ' grep ipaddr/etc/sysconfig/network-scripts/ifcfg-eth0|sed ' s/IPADDR=//g '"--"SSH| $SSH _connection $SSH _tty "--" user| $USER "--" pwd| $PWD "]:" $msg "; }‘

The network card name here should be modified according to the actual situation

Restart Service

Service Rsyslog Restart

This article from "Do not abandon!" Do not give up "blog, be sure to keep this source http://thedream.blog.51cto.com/6427769/1833026

Using Rsyslog to audit Linux operations