topic Re: history record in Operating System - HP-UX

history record

asce — Mon, 14 Aug 2006 19:48:26 GMT

Hello，
I want to record in the system all users' operation, how do I need to do? Thanks！

Re: history record

rayche — Mon, 14 Aug 2006 21:05:35 GMT

Under user's home direcory, there is .sh_history file, you can find operation history from that file

Re: history record

Michael Steele_2 — Mon, 14 Aug 2006 21:56:28 GMT

Depends upon the shell. For ksh use HISTSIZE. I.e., in /home/user/.profile include:

export HISTSIZE=3000

HISTSIZE 3000 will record the last 3000 commands of the user. Default is about 100. To search type in 'history'. I.e.,

history -1000 | grep -i command

Re: history record

Marek Mahut — Tue, 15 Aug 2006 04:55:16 GMT

Hello,

you can define $HISTFILE variable in user profile file too.

For example:
export HISTFILE=/root/users_history/$USER.log
export HISTSIZE=900000000

and don't forget to set right permission for /root/users_history/

Re: history record

spex — Tue, 15 Aug 2006 06:31:18 GMT

Hello,

Under sh-posix and ksh, command history is saved to ~/.sh_history by default. To see the complete history for all users:

# more /home/*/.sh_history

To see the last ten commands entered by all users:

# find /home -name .sh_history -exec tail -n 10 {} \;

Set $HISTSIZE=5000 in each user's ~/.profile to keep a large command history for each user.

PCS

Re: history record

Geoff Wild — Tue, 15 Aug 2006 07:33:38 GMT

If you expect to have a total record - you can't.

Though if you convert to a trusted system, you can turn on auditing.

With .sh_history - users can delete it whenever they like.

Rgds...Geoff

Re: history record

spex — Tue, 15 Aug 2006 08:46:54 GMT

Hi,

Read up on the 'script' command, which makes a typescript of everything on the terminal. You could add the following to /etc/profile:

# script -a /tmp/scr-$(whoami).log

If you modify your users' $PS1 prompt to display the current date/time, items in your typescript will be timestamped.

PCS

Re: history record

Marvin Strong — Tue, 15 Aug 2006 08:49:03 GMT

Shell histories are ok, but as stated a user can clear it out whenever they want. The only way would be with auditing, and If you are recording everything users do, I suspect you are going to need a decent sized disk, depending on how long you plan to keep the logs.

Re: history record

asce — Thu, 08 Jan 2009 17:01:08 GMT

thanks!