Recording all the command history in a log

xploreraj · 11-12-2013, 07:53 AM

Hello.

Thank you for reading my post.
I have a requirement. I have multiple Linux users sharing the same home path. Multiple terminals may be used for logging in by these different users. I want to generate a log file for all the commands issued for this particular home path along with the username.

I have tried redirecting "history" to a file in the ".login" file itself, but this repeats the information. I can not find any other solution. I am a novice in UNIX programming and I have a C shell.

Please help me in the best logging technique in terms of complexity as well as information.

Regards,
Raj

druuna · 11-12-2013, 08:24 AM

This has been asked many times before.

You might want to start here: Bash logging patches (Blog entry from unSpawn one of our Moderators).

xploreraj · 11-13-2013, 12:28 AM

It looks very complex...Could you please guide me to a simple script or some ideas. I have a C shell and want this to be very simple.

pan64 · 11-13-2013, 01:07 AM

have you heard about the command screen? Is this what you are looking for?

xploreraj · 11-13-2013, 11:49 PM

I just want the "history" command but in a more meaningful way like recording the username and commands that user executed. The same home path will be shared by multiple users (the users I don't know, I only know that the users will share the same home path), and I want to log every user for same home path.

What I have tried is:
1. In .login file in the home path, I have redirected history to a log so that when an user logs in then the history at the point gets written to the log. Then the current user performs some commands and these are saved in history. When again logged in, any user which has same home path, the .login file will execute and the history of previous login will be logged.
But this has limitations:
- The history is duplicated, even if I delete the .history file at the home path, so a lot of duplicate data in the log file.
- History is written in next login only. So the last login will not have the commands logged.
- The log is not properly managed as the username and history are not properly mapped.

2.
2.1 Written a script: loggerscript.sh

Code:

#!/bin/csh

set logname=usercommandhist_`date +%Y%m%d_%H%M%S`.log
echo "Current user is:" $user >> $logname
script -aq $logname

2.2 Given it permission from main user:

Code:

chmod -R g+rwx $HOME/loggerscript.sh

to run in whole group.
2.3 In .login file, added

Code:

./loggerscript.sh

This has problems:
- Everything is logged, not just commands, the whole screen.
- 'exit' command has to be issued an extra time to stop the script by each user, and I don't want the users to know about the login.
- The data saved in log has many junk values
For example,

Quote:

[1mlinux89[0m /home/user1> ls
[0m[01;34mABC[0m [00mddr.txt[0m

So I hope I have explained what I am trying to do and where I am stuck.

Regards,
Raj

voleg · 11-14-2013, 07:10 AM

man bash:

Quote:

HISTFILE
The name of the file in which command history is saved (see HISTORY below).
The default value is ~/.bash_history. If unset, the command history is not
saved when an interactive shell exits.

Put this in your .bash_profile:

Code:

export HISTFILE=~/.bash_history_$LOGNAME

This way history will be separated even in shared $HOME.
Read man for more options about history.

druuna · 11-14-2013, 07:19 AM

@voleg: I do believe the OP is using a C-Shell and not Bash.

@xploreraj: You do realize that any user can delete/edit the files in his/her home directory? That's the reason I pointed you to unSpawn's blog entry; Those implementations should prevent just that.

xploreraj · 11-15-2013, 01:33 AM

Ok. I am seeing.

xploreraj · 11-24-2013, 11:30 PM

Hi there. Hope I find you all well. I have made some changes. Since I have the need for an IBM AIX 5.3 machine, I have to change the following two files:
1. /etc/profile (for all non-C shell users)
2. /etc/csh.login (for C shell users)

After adding the following script, when the root user logs in, then the logs are created for all the users under following directory:
/var/audit_log/<username>/<xxxxx.log>
This is working for non C shell users, but when the same script is added to csh.login in C syntax, then it does creates the necessary directory, but does not writes the history log. I have seen in some places that for C shell the histfile can not be set, but I want the logs to be written in a similar fashion as other shell users (the code in /etc/profile).

Please help.

The script is:

Code:

echo "welcome to C SHell <csh.login file>"

setenv USER_IP `who -u am i | awk '{print $NF}'|sed -e 's/[()]//g'`
if ( "X${USER_IP}" == "X" )  then
        setenv USER_IP `hostname`
endif

if ( ! -d /var/audit_log )  then
        mkdir /var/audit_log
        chmod 777 /var/audit_log
endif

if ( ! -d /var/audit_log/${LOGNAME} ) then
        mkdir /var/audit_log/${LOGNAME}
        chmod 300 /var/audit_log/${LOGNAME}
endif

set savehist=9999

setenv DT `date "+%Y%m%d_%H%M%S"`
set histfile=/var/audit_log/${LOGNAME}/${USER_IP}_$DT