LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - General
User Name
Password
Linux - General This Linux forum is for general Linux questions and discussion.
If it is Linux Related and doesn't seem to fit in any other forum then this is the place.

Notices


Reply
  Search this Thread
Old 06-13-2005, 05:24 PM   #1
junaid18183
Member
 
Registered: Mar 2005
Location: India
Distribution: RedHat 9.0 and EL
Posts: 31

Rep: Reputation: 15
history


Hi to all,

Can any body give me some idea about how to track what are the activities done by the each user on particuler date.

Let me clear what I want

1] the
Code:
last
command displays a list of all
users logged in (and out) and other info like system start and shutdown.

Now using this info I come to know that on particuler day which user has logged on to the system.

2] Using this info I want ,what activities he/she has done on that day ?


.bash_history file in the home directory of each user gives a good info about which command he/she has run in the past but dont give any idea about the date.


any idea ?

Thanks
 
Old 06-13-2005, 06:36 PM   #2
Tinkster
Moderator
 
Registered: Apr 2002
Location: in a fallen world
Distribution: slackware by choice, others too :} ... android.
Posts: 23,067
Blog Entries: 11

Rep: Reputation: 914Reputation: 914Reputation: 914Reputation: 914Reputation: 914Reputation: 914Reputation: 914Reputation: 914
If you're using bash 3.x and have HISTTIMEFORMAT set
you would be able to get time-stamps. If your bash is a)
older or b) you didn't set it there's no way of finding out
what was done when.


Cheers,
Tink
 
Old 06-13-2005, 06:44 PM   #3
junaid18183
Member
 
Registered: Mar 2005
Location: India
Distribution: RedHat 9.0 and EL
Posts: 31

Original Poster
Rep: Reputation: 15
Quote:
If you're using bash 3.x and have HISTTIMEFORMAT set
How Could I check it.

rpm -q bash
bash-2.05a-13
gives me the version of bash

Last edited by junaid18183; 06-13-2005 at 06:46 PM.
 
Old 06-13-2005, 06:49 PM   #4
Tinkster
Moderator
 
Registered: Apr 2002
Location: in a fallen world
Distribution: slackware by choice, others too :} ... android.
Posts: 23,067
Blog Entries: 11

Rep: Reputation: 914Reputation: 914Reputation: 914Reputation: 914Reputation: 914Reputation: 914Reputation: 914Reputation: 914
Well ... that's enough of a check, then. The older versions
of bash just didn't have the facility at all.


Cheers,
Tink
 
Old 06-13-2005, 06:52 PM   #5
Artanicus
Member
 
Registered: Jan 2005
Location: Finland
Distribution: Ubuntu, Debian, Gentoo, Slackware
Posts: 827

Rep: Reputation: 31
lemme just jump in here out of curiosity, I have bash over 3.0 and was wondering, what do I need to shove to the variable? Just 1, or the actual time format? Would the format be a 'date +%blaablaa' sequence, or what?
 
Old 06-13-2005, 07:06 PM   #6
junaid18183
Member
 
Registered: Mar 2005
Location: India
Distribution: RedHat 9.0 and EL
Posts: 31

Original Poster
Rep: Reputation: 15
Quote:
Well ... that's enough of a check, then
obviously,but if suppose it is greater than 3.x then how to check for the HISTTIMEFORMAT

I have checked the SHELLOPTS variable it does not have such things

Dont want to miss a learning new thing

Again from original question, is there any way in KDE or GNOME to find such ,

Because windows have such facilty ( history,recent files,temp files etc. though it can be deleted by any one, but if in place gives a good information for the above topic.)

Thanks
 
Old 06-13-2005, 07:26 PM   #7
Tinkster
Moderator
 
Registered: Apr 2002
Location: in a fallen world
Distribution: slackware by choice, others too :} ... android.
Posts: 23,067
Blog Entries: 11

Rep: Reputation: 914Reputation: 914Reputation: 914Reputation: 914Reputation: 914Reputation: 914Reputation: 914Reputation: 914
Quote:
Originally posted by Artanicus
lemme just jump in here out of curiosity, I have bash over 3.0 and was wondering, what do I need to shove to the variable? Just 1, or the actual time format? Would the format be a 'date +%blaablaa' sequence, or what?
Yep, it uses strftime strings ... a
man bash
/HISTTIMEFORMAT
would have answered that too, though ;}

Quote:
Originally posted by junaid18183
I have checked the SHELLOPTS variable it does not have such things
If you don't set it it's not there. If you want/need it, put
it in ~/.bashrc (~/.bash_logon) ...

Quote:
Originally posted by junaid18183
Because windows have such facilty ( history,recent files,temp files etc. though it can be deleted by any one, but if in place gives a good information for the above topic.)
find / -user <name> -ctime -<days-back> -ctime +<days-back-1>
should give you all files that are owned by that user and have been
modified <days-back> ago ...


Cheers,
Tink
 
Old 01-31-2008, 11:56 AM   #8
mohammednv
LQ Newbie
 
Registered: Mar 2007
Posts: 22

Rep: Reputation: 20
Hmm..... I tried setting HISTTIMEFORMAT in .bashrc. But, didn't work as I expected.

If I set this in .bashrc, history always show time of user login, no matter when these commands are executed. I would like to get the actual time when user executed those commands.

--------------------------------------------------
[mohammed@41 ~]$ date
Thu Jan 31 21:11:37 IST 2008
[mohammed@41 ~]$ history | tail -2
1010 2008-Jan-31::21h:09m:52s date
1011 2008-Jan-31::21h:09m:52s history | tail -2
[mohammed@41 ~]$
[mohammed@41 ~]$ echo hello
hello
[mohammed@41 ~]$ echo hi
hi
[mohammed@41 ~]$ date
Thu Jan 31 21:12:01 IST 2008
[mohammed@41 ~]$ history | tail -6
1010 2008-Jan-31::21h:09m:52s date
1011 2008-Jan-31::21h:09m:52s history | tail -2
1012 2008-Jan-31::21h:09m:52s echo hello
1013 2008-Jan-31::21h:09m:52s echo hi
1014 2008-Jan-31::21h:09m:52s date
1015 2008-Jan-31::21h:09m:52s history | tail -6
--------------------------------------------------

Depending on default history setting is not always good. Commands you executed in the present console will be written to your history file (.bash_history by default) only when logout from that console. (Even though 'history' command will show you all commands you executed, it will be written to the file only when you logout). And I think, it wont be written if you just close the session or you are timed out from the session.

Also, what if you are logged into the same machine as same user from different consoles. How the commands will be written into the .bash_history file. I haven't checked this, but you can test it very easily.

So, what I am trying to do is, execute "history -a newhistfile" frequently within a script. This should write all commands executed in the present console to newhistfile. Unfortunately, this command is not working when I kept this in a script.

In short, what I want is to log all activities by every users.

Any ideas??. And any other way to do this??.

Regards,
Mohammed.
 
Old 02-02-2008, 09:07 AM   #9
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594
Quote:
Originally Posted by mohammednv View Post
Hmm..... I tried setting HISTTIMEFORMAT in .bashrc. But, didn't work as I expected.
It's strftime, so 'export HISTTIMEFORMAT='%Y-%b-%d::%Hh:%Mm:%Ss '' should do.


Quote:
Originally Posted by mohammednv View Post
In short, what I want is to log all activities by every users.
Would have cost you only one post if you stated that in your OP.
You'll want to use a wrapper like Rootsh.
FWIW: install, test it, *then* ask.
 
Old 02-02-2008, 10:10 AM   #10
mohammednv
LQ Newbie
 
Registered: Mar 2007
Posts: 22

Rep: Reputation: 20
history -a file

Thanks for your reply.

I am trying rootsh now.

BTW, could you please help me with this?.

The command "history -a testhist" will write all commands executed within present console to the file testhist. But, it is not working when I try it as a script. I also tried like "eval `history -a testhist`" and
"exec `history -a testhist`"......but no luck .

I think it's because, there is no binary associated with history and so it's not a recognized command. Actually, I don't how history works. Sometimes, answer to this questions may resolve everything

If it works, I can run the script periodically by inserting a timestamp.

Any ideas??.

Regards,
Mohammed.
 
Old 02-02-2008, 02:18 PM   #11
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594
Quote:
Originally Posted by mohammednv View Post
Actually, I don't how history works. Sometimes, answer to this questions may resolve everything
The history list is only active during interactive shells. So, onto Rootsh I'd say.
 
Old 02-10-2008, 01:45 AM   #12
mohammednv
LQ Newbie
 
Registered: Mar 2007
Posts: 22

Rep: Reputation: 20
Red face hey, I got this working in a script

Hi,

At last I got 'history -a' command working within a script.

Here is what I did:

echo 'history -a .local_`date +%Y%b%d`' > hist
then added "source hist" into .bash_logout and that worked !!!.

Also, if you want to bring all these logfiles under root's ownership:
1. Either set a crontab under root to copy logfiles from all users.
2. Or write a setuid program which copies these logfiles into a file under root's ownership. Then run this at bash_logout.

Thanks,
Mohammed.
 
Old 03-17-2009, 10:42 AM   #13
varu0612
LQ Newbie
 
Registered: Mar 2009
Posts: 4

Rep: Reputation: 0
Quote:
Originally Posted by mohammednv View Post
Hmm..... I tried setting HISTTIMEFORMAT in .bashrc. But, didn't work as I expected.

If I set this in .bashrc, history always show time of user login, no matter when these commands are executed. I would like to get the actual time when user executed those commands.

--------------------------------------------------
[mohammed@41 ~]$ date
Thu Jan 31 21:11:37 IST 2008
[mohammed@41 ~]$ history | tail -2
1010 2008-Jan-31::21h:09m:52s date
1011 2008-Jan-31::21h:09m:52s history | tail -2
[mohammed@41 ~]$
[mohammed@41 ~]$ echo hello
hello
[mohammed@41 ~]$ echo hi
hi
[mohammed@41 ~]$ date
Thu Jan 31 21:12:01 IST 2008
[mohammed@41 ~]$ history | tail -6
1010 2008-Jan-31::21h:09m:52s date
1011 2008-Jan-31::21h:09m:52s history | tail -2
1012 2008-Jan-31::21h:09m:52s echo hello
1013 2008-Jan-31::21h:09m:52s echo hi
1014 2008-Jan-31::21h:09m:52s date
1015 2008-Jan-31::21h:09m:52s history | tail -6
--------------------------------------------------

Depending on default history setting is not always good. Commands you executed in the present console will be written to your history file (.bash_history by default) only when logout from that console. (Even though 'history' command will show you all commands you executed, it will be written to the file only when you logout). And I think, it wont be written if you just close the session or you are timed out from the session.

Also, what if you are logged into the same machine as same user from different consoles. How the commands will be written into the .bash_history file. I haven't checked this, but you can test it very easily.

So, what I am trying to do is, execute "history -a newhistfile" frequently within a script. This should write all commands executed in the present console to newhistfile. Unfortunately, this command is not working when I kept this in a script.

In short, what I want is to log all activities by every users.

Any ideas??. And any other way to do this??.

Regards,
Mohammed.

Hi,

Do you have any idea how i can get the real time when the command has been executed and not the logout time ?

Thanks!
 
Old 11-07-2009, 02:03 AM   #14
mohammednv
LQ Newbie
 
Registered: Mar 2007
Posts: 22

Rep: Reputation: 20
Yes, you can add this line to your bashrc or profile file.

HISTTIMEFORMAT="%h-%d-%Y - %H:%M:%S "

~mohammed
 
Old 11-07-2009, 08:01 AM   #15
catkin
LQ 5k Club
 
Registered: Dec 2008
Location: Tamil Nadu, India
Distribution: Debian
Posts: 8,578
Blog Entries: 31

Rep: Reputation: 1198Reputation: 1198Reputation: 1198Reputation: 1198Reputation: 1198Reputation: 1198Reputation: 1198Reputation: 1198Reputation: 1198
But shell history is a user convenience, not an audit tool. As mohammednv mentioned there are ways that a user can do things and not have them appear in the history file (there are other ways, too). Especially if you are trying to detect malfeasance by a competent user, shell history is useless.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
history saipraveen Linux - Newbie 5 06-10-2005 08:04 PM
about history jackandking Programming 1 12-18-2004 03:10 PM
How to find back "history" database after "history -c" ? san_lss Linux - Newbie 1 01-07-2004 12:53 PM
History file juno Linux - General 1 01-07-2003 02:26 AM
History neohybrid1 Linux - General 1 12-03-2002 05:53 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - General

All times are GMT -5. The time now is 07:20 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration