topic Re: Maintaining log for command being type on workstation in Operating System - HP-UX

Maintaining log for command being type on workstation

Henry Chua — Sun, 18 Sep 2005 19:37:49 GMT

Hi Guys,

I was just wondering, is it possible to maintain a log of all command being type on a workstation. Even from remote login?

Thanks

Henry

Re: Maintaining log for command being type on workstation

Bill Hassell — Sun, 18 Sep 2005 20:19:25 GMT

If you setup the shell variable HISTFILE in .profile, then commands will be logged. Note that only commands will be logged, not the interaction with the command itself such as vi (you won't see what was typed in vi). Put this in .profile:

export HISTFILE=$HOME/.sh_history

The user commands will be in the .sh_history file. Now the above line assumes several things: the standard shell /usr/bin/sh, and the user actually logs in using something like telnet or rlogin. For non-standard shells like csh, a single command such as remsh, or non-standard connections such as CDE, there are diferent or additional steps.

Now to log everything including interaction with other programs, you can use the script command.

Re: Maintaining log for command being type on workstation

Henry Chua — Sun, 18 Sep 2005 20:49:32 GMT

Hi Bill,

Thanks for the reply. Will this data be flushed whenever i logged off? Is there a way to prevent this. And is there a way to include a time stamp on when each command have been executed?

Regards
Henry

Re: Maintaining log for command being type on workstation

Devender Khatana — Sun, 18 Sep 2005 21:04:35 GMT

Hi,

The data in history file will not be removed when logging off.

Putting a time stamp for each file is not possible with this.

Script command can also be used to achive this for a particular session. script also has -a option to append to previous file.

HTH,
Devender

Re: Maintaining log for command being type on workstation

morganelan — Sun, 18 Sep 2005 21:14:46 GMT

You must set two shell variables HISTFILE and HISTSIZE to maintain history of your commands that have been executed on your HPUX Machine.
The history file specified by HISTFILE contains the latest commands you executed at your terminal. Every time you type a command at the prompt and press Return it is stored in this history file. HISTSIZE specifies the maximum number of commands stored in that file. For example:

HISTFILE=/users/test/.history
HISTSIZE=100

If you do not set these two variables in your .profile, the shell defaults to a file named .sh_history of 128 lines.

The history mechanism keeps continuous record of the most recent commands you have executed, even if you log out and back into the system many times or execute the commands in a subshell.

Re: Maintaining log for command being type on workstation

Vibhor Kumar Agarwal — Mon, 19 Sep 2005 00:11:37 GMT

I'll say go by the "script" option.

Becasue with history, if you exceed the size, the older commands will be overwritten.

Further script will give you more detail output.

Re: Maintaining log for command being type on workstation

Joseph Loo — Mon, 19 Sep 2005 00:36:15 GMT

hi,

do for:

each users:
# vi ~/.profile
insert -->
export HISTSIZE=1000
export HISTFILE=/.sh_history

the thing with .sh_history in each user profile is that they may amend that file as well.

if it is for auditing purpose, convert to trusted and turn auditing on.

regards.

Re: Maintaining log for command being type on workstation

Arunvijai_4 — Mon, 19 Sep 2005 00:43:32 GMT

Hi Henry,

A similar thread you might want to look at it,

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=957735

-Arun

Re: Maintaining log for command being type on workstation

Muthukumar_5 — Mon, 19 Sep 2005 01:20:52 GMT

Setup history enablement in your shell if you want to log command being typed as,

--- /etc/profile ---

set -o vi
export HISTFILE=/tmp/history_${LOGNAME}_$(date +'%d-%m-%y')
export HISTSIZE=2000

You can change HISTFILE setting.

hth.

Re: Maintaining log for command being type on workstation

Edgar_8 — Tue, 20 Sep 2005 04:15:33 GMT

Hi Henry,

I would suggest the following change to the .profile file:

TTY=$(tty)
TTYBASE=$(basename $TTY)
stty erase ^?
export HISTFILE=/.sh_history/$TTYBASE

This will create a new history file based on terminal.

hth

Re: Maintaining log for command being type on workstation

Raj D. — Tue, 20 Sep 2005 05:06:24 GMT

Hi Henry ,

You need to add script in .profile script.

You can log all the session commands including session output with following:

1. In each user .profile , add the script command , So it will generate all the details of their session , with the file name.

Remember it will need additional space.
Line to add:

script $HOME/log/`whoami`.`date +%d%m%y"."%T`

So the file will have complete log of the user at that session , and close the log when he/she will logoff.. For details see: # man script.

Cheers,
Raj.

Re: Maintaining log for command being type on workstation

Raj D. — Tue, 20 Sep 2005 05:10:13 GMT

Henry ,

Little correction :

Check this out :

$ mkdir $HOME/log
$ script "$HOME/log/`whoami`.`date +%d%m%y"."%T"

Dont cat the output file .., you can check from another session.

Enjoy,
Cheers,
Raj.

Re: Maintaining log for command being type on workstation

Muthukumar_5 — Tue, 20 Sep 2005 05:38:37 GMT

If you are going to try with script command then be aware disk usage. It will use more disk space that it gathers all typed command and results also.

It is better to keep history level itself when you are bothering about disk space also.

hth.

Re: Maintaining log for command being type on workstation

Marlou Everson — Tue, 20 Sep 2005 14:34:11 GMT

Henry,

You may want to look at this thread (Is there a way to timestamp commnd history) for including a timestamp with the command.

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=896650

Marlou