topic Logging commands executed in shell in Operating System - HP-UX

Logging commands executed in shell

Laszlo Csizmadia — Wed, 10 Aug 2005 11:20:30 GMT

Is there any good and straightforward way on HP-UX to log commands executed in a shell?
Obviously there is .sh_history and .bash_history but it not very accurate. (If you just close the putty window or login simultaneously with same account it doesn't updated well.)
And I also want to see the time when a given command was executed which not included in shell history files.

I would appreciate any ideas…
Thanks in advance.

Re: Logging commands executed in shell

Mel Burslan — Wed, 10 Aug 2005 11:27:54 GMT

You can use a product like powerbroker and require user to start his/her session with

pbrun ksh # (or shell of your choice)

from this moment on, every keystroke they make gets recorded in PB logs. It is not a free product, but has very good logging capabilities as well as delegation of authority features.

visit :

http;//www.symark.com

for more information.
HTH

Re: Logging commands executed in shell

melvyn burnard — Wed, 10 Aug 2005 11:35:45 GMT

you could use script. Set it up to execute as they logon in their profile, and it will create a file which you could name using date/time extensions, and this records all commands they issue while logged in on this session.
man script

Re: Logging commands executed in shell

Laszlo Csizmadia — Wed, 10 Aug 2005 11:39:55 GMT

Powerbroker seems a good a sophisticated tool but I would prefer some HP tool.
(Or something open source with GPL license.)
BTW is it possible to do this with HP-UX own accounting mechanism? Man acct.

Re: Logging commands executed in shell

Laszlo Csizmadia — Wed, 10 Aug 2005 11:43:51 GMT

Thanks Melvyn! I guess you mean sg like this e.g.:
# Set up shell history file
myterm=`ps | tail -1 | awk '{print $2}'`
export HISTFILE=$HOME/.sh_history.`who -R|grep \$myterm|awk '{print $6}'
|sed s/$//|sed s/$//`

But it doesn't log timestamp for commands. And it not really working if you just close your teminal. It just solve the problem of simultaneous login.

Re: Logging commands executed in shell

Olivier Masse — Wed, 10 Aug 2005 11:45:19 GMT

We use the auditing susbsystem, and log all exec() calls. This has worked good for us. However there is a bug if you login using SSH as it's not self-auditing as telnetd is. I've published a workaround here:
http://www.mayoxide.com/audenable/

Another alternative is documented here:
http://honeypots.sourceforge.net/modified_script.html

I started porting this to HP-UX some time ago (can give you my sources if you want) but found it to be too risky for corner cases.

Olivier.

Re: Logging commands executed in shell

Rick Garland — Wed, 10 Aug 2005 11:49:44 GMT

Using the HIST file, can incorporate date/time

# Set History File
HISTFILE=/home/root/.sh_history_"${HST}"_"${USR}"-as-"${NAME}"_`date +%y%m%d.%H%M%S_$$`
export HISTFILE

The 1-liner you posted just recently can have the date functionality included with it. This way you get the date/time stamps as well.

Re: Logging commands executed in shell

Laszlo Csizmadia — Wed, 10 Aug 2005 12:12:25 GMT

Thanks Olivier!!
I exactly looking for something like this. I'll have a look at these tomorrow. Thanks.

Re: Logging commands executed in shell

Laszlo Csizmadia — Wed, 10 Aug 2005 12:14:42 GMT

Rick,

but I want a timestamp when e.g. the "ls -lR" was executed by user xyz.
What you wrote here just append a timestamp to the history file.