I occasionally run into a situation where I need to know more details about the command history than just the list of commands generated by the Bash history command.
Is there a (relatively simple) way to generate a more inclusive log file which works as follows:

1) Logs all commands issued by root,
2) Logs commands from multiple terminal windows simultaneously and to a single file,
3) Logs the commands in real time, in the order they were issued, and
4) Puts a date/time stamp on each command

That may be a lot to ask, but what I'm describing seems like a feature/function that a lot of system admins might find useful. Does a tool like this exist somewhere already?

Another related question:
Is there a setting that can be "switched on" which will include commands run from within Bash shell scripts in your Bash history file?

The only purpose to this is to help me find out exactly what happened in my server; primarily by seeing how commands issued by different administrators from different terminals might have interacted, especially if they were working on closely related parts in the system.


If it's important to include this, I'm running Fedora Core 6 & 7 and Red Hat Enterprise 4 & 5.

As a partial answer: add (or another accepted time format) to your .bashrc file to get a timestamp on all commands - note the trailing space included in quotes.

Also, the sudo util can log both successful and failed attempts, which may be useful.

That's a good start!

Now, would there be a good way to snag new entries from the temporary history file (that each command shell keeps until it's closed) and drop them into a permanent file? As far as that goes, where is the temporary history file? And what's it's filename?




I don't understand here. Successful & failed attempts to do what? Enter a command?


Thanks to you both!