topic Re: How To Timestamp the KORN Shell History File in Operating System - HP-UX

How To Timestamp the KORN Shell History File

Michael Steele_2 — Wed, 09 Mar 2011 19:15:30 GMT

To Whom It May Concern:

If your like me and you've been looking for the BASH 'HISTTIMEFORMAT' equivalent for HPUX KSH, well, here it is and I think this is what your E&Y auditors will be happy to see.
####################################
My .profile File
> cat .profile
set -u # error if undefined variable.
trap "echo 'logout root'" 0 # what to do on exit.
trap 'date "+#%c" | read -s' debug # timestamp .sh_history
export HISTFILE=/tmp/$LOGNAME`date +%m%d%y%H%M%S` # Put it in /tmp

My .sh_history file
AKA /tmp/$LOGNAME030911134105

> cat /tmp/f808636030911134105

trap 'date "+# %c" | read -s' debug
# Wed Mar 9 13:42:24 2011
'date "+# %c"'
# Wed Mar 9 13:42:35 2011
history
# Wed Mar 9 13:42:45 2011
trap 'date "+# %c" | read -s' debug
# Wed Mar 9 13:43:02 2011
hisot
# Wed Mar 9 13:43:38 2011
thi
# Wed Mar 9 13:46:14 2011
history
# Wed Mar 9 13:46:16 2011
dog
# Wed Mar 9 13:46:55 2011
cat
ls -la
# Wed Mar 9 13:47:03 2011
cat /etc/passwd
# Wed Mar 9 13:47:09 2011
history
# Wed Mar 9 13:47:12 2011
cat /etc/group
# Wed Mar 9 13:48:34 2011
history
# Wed Mar 9 13:48:36 2011
cat /etc/fstab
# Wed Mar 9 13:48:43 2011
history
# Wed Mar 9 13:48:45 2011
vgdisplay
# Wed Mar 9 13:48:53 2011
history
# Wed Mar 9 13:48:57 2011
vi .profile
# Wed Mar 9 13:50:25 2011
id
# Wed Mar 9 13:50:28 2011
ps
# Wed Mar 9 13:50:29 2011
exit
# Wed Mar 9 13:50:30 2011

Re: How To Timestamp the KORN Shell History File

Shibin_2 — Thu, 10 Mar 2011 02:33:28 GMT

Good to see. Unfortunately, when I tried the option, got the following error:

DEBUG : Max recursion reached it's limit, exiting

I am unable to login. :(

Re: How To Timestamp the KORN Shell History File

Steven Schweda — Thu, 10 Mar 2011 03:02:22 GMT

> [...] your E&Y auditors will be happy to see.

> [...] # Put it in /tmp

So, anyone can play with it? How happy does
that keep everyone?

Re: How To Timestamp the KORN Shell History File

Michael Steele_2 — Thu, 10 Mar 2011 04:13:29 GMT

Shibin:
That's interesting. Well if nothing ever worked then you've missed something but if you're saying it worked for awhile and then bombed then its of no use. I'll see if I can recreate the same.
Thanks!

Steven:
Please get back on your Thorazine medication and remember to take your afternoon nappy poo. You'll feel better.

Re: How To Timestamp the KORN Shell History File

Michael Steele_2 — Thu, 10 Mar 2011 16:13:18 GMT

Shibin:

Hey, I've run this now all morning with multiple sessions in root on both pa-risc 11.23 and ia64 11.23 and see none of what you are reporting.

?

Re: How To Timestamp the KORN Shell History File

Steven E. Protter — Thu, 10 Mar 2011 22:27:35 GMT

I think this is a great addition.

Thanks.

I will play with it in the lab. Hopefully next week.

SEP

Re: How To Timestamp the KORN Shell History File

Bill Hassell — Fri, 11 Mar 2011 01:30:51 GMT

Here's a slight mod that makes the history a bit easier to read (YYYYMMDD.HHMMSS):

# trap 'date "+ # %a %Y%m%d.%H%M%S" | read -s' debug
5089 # Thu 20110310.202507
5090 ls
5091 # Thu 20110310.202509
5092 date
5093 # Thu 20110310.202510
5094 bdfmegs
5095 # Thu 20110310.202513
5096 boiotinfo
5097 # Thu 20110310.202514

Now the commands are visible on the left with the timestamps pushed to the right. This is the only line you'll need for .profile to add timestamps to each line in the shell history file. Thanks for posting this technique Michael.

Re: How To Timestamp the KORN Shell History File

Shibin_2 — Fri, 11 Mar 2011 02:23:12 GMT

Michael,

Thanks. I have tested it in another PA RISC, works fine. I hope I can use the same in my AIX machine :) .

Not sure, what happened to the earlier machine. I have to boot into single user mode to recover that now. ( tested in root user .. he he ).

Re: How To Timestamp the KORN Shell History File

Hakki Aydin Ucar — Fri, 11 Mar 2011 11:36:34 GMT

I used HP-UX 11iv1 PA-Risc box and worked good, great workaround!

Re: How To Timestamp the KORN Shell History File

Michael Steele_2 — Fri, 11 Mar 2011 15:17:36 GMT

Yes. I like this better.

-/root> grep trap .profile

trap 'date "+ #%c" | read -s' debug # timestamp .sh_history

Thanks Bill Hassell.

-/root> history
389 # Fri 20110311.081338
390 # Fri 20110311.081338
391 history
392 # Fri 20110311.081341
393 history
394 # Fri 20110311.081346
395 # Fri 20110311.081354
396 history
397 vi .profile
398 . ./.profile
399 #Fri Mar 11 08:14:35 2011
400 #Fri Mar 11 08:14:35 2011
401 #Fri Mar 11 08:14:35 2011
402 #Fri Mar 11 08:14:35 2011
403 #Fri Mar 11 08:14:35 2011
404 history
root@fxgpq506-/root>

Re: How To Timestamp the KORN Shell History File

Hakki Aydin Ucar — Fri, 11 Mar 2011 15:32:22 GMT

Bill' s addendum looks good.

Micheal;
the only thing I noticed that after exit root, history was being cleaned.
But you keep records under /tmp already,
so the second step I wonder if time stamp can be in same line with the command we issued ?

Re: How To Timestamp the KORN Shell History File

Michael Steele_2 — Fri, 11 Mar 2011 16:22:17 GMT

Hakki:

"...regarding the only thing after exit root has been cleaned..." - This has been the latest security recommendation unless you've got auditors like I have and they want time stamps on every root command.

Anyway Hakki, this is why I put this command in:

trap "echo 'logout root'" 0 # what to do on exit.

...you didn't read the whole posting.

As for having the time stamp on the same line as the command as well as the line number, i.e.,

2Wed Mar 9 13:50:29 2011 ps
3Wed Mar 9 13:50:30 2011 exit

....is the BASH / HISTTIMEFORMAT method that I was looking to reproduce for auditing purposes and have not been able to.

But if you do please let me know. Thanks!

Re: How To Timestamp the KORN Shell History File

Steven E. Protter — Fri, 11 Mar 2011 18:25:24 GMT

Shalom,

No points, not fishing.

I tried it out in the lab. The Bill Hassell modification is working.

I'd say as far as figuring out who did what to a system when, this could be useful, though obviously it increases the size of logs.

We probably have some collection procedure in place and I'm worried some kind of SOX report might get unhappy with this hack.

Still, its a great hack.

SEP

Re: How To Timestamp the KORN Shell History File

Shibin_2 — Wed, 16 Mar 2011 03:21:06 GMT

AIX Korn shell trapped me.

It's giving me the same error

"DEBUG : Max recursion reached it's limit, exiting"

Unable to login. I tried different signals, but no time stamp records. Could it be related to any kernel parameter ? Any AIX gurus here ?

Re: How To Timestamp the KORN Shell History File

Hakki Aydin Ucar — Wed, 12 Apr 2017 12:02:17 GMT

>Michael: But if you do please let me know. Thanks!

Michael, I couldn't go further but I found that ,are you aware of the parameter EXTENDED_HISTORY in korn shell, I coukdn't find in my environment but if you check this out:

To start recording the date and time that each command is executed, set the EXTENDED_HISTORY environment variable to ON:
export EXTENDED_HISTORY=ON
The CUT (Coordinated Universal Time) timestamp will be appended
to each line of the ~/.sh_history file.

[broken link removed on <4/12/2017> by Mod]

Re: How To Timestamp the KORN Shell History File

Shibin_2 — Wed, 16 Mar 2011 06:24:43 GMT

Hakki,

I tested it in my AIX and HP-UX servers.

HP-UX .. no luck. It's not recording any time stamps.

But AIX, it records, but very difficult to identify what is the exact date and time (see below). :)

ls -la #Ã #1300259962#Ã #
tail .sh_history #Ã #1300259975#Ã #

HP-UX 11.23 PA-RISC
AIX P570 6.1

I think, it is depends on the ksh version we use.

Re: How To Timestamp the KORN Shell History File

Hakki Aydin Ucar — Tue, 03 May 2011 11:40:57 GMT

if you are not consider security issue ,here is my workaround solution, at the end of the .profile ;

# cat /.profile
...
## timestamp to history file ..
set -u # error if undefined variable.
trap 'date "+%c" | read -s' debug # timestamp .sh_history

# cat /tmp/hist_reader
#!/bin/sh
# reader for ksh history from current with timestamp

ADDRESS="$HOME/.sh_history"
cat $ADDRESS >> /tmp/temporal
sed 'N;s/\n/\ : /' < /tmp/temporal

Result:
# /tmp/hist_reader
Tue May 3 15:32:43 2011 : bdf
Tue May 3 15:32:45 2011 : Bpsm
Tue May 3 15:32:48 2011 : pwd
Tue May 3 15:32:52 2011 : history
Tue May 3 15:32:55 2011 : ./
Tue May 3 15:33:05 2011 : ls
Tue May 3 15:33:25 2011 : cat /.profile
Tue May 3 15:36:37 2011 : pwd
Tue May 3 15:37:47 2011 : ls
Tue May 3 15:38:31 2011 : uptime
Tue May 3 15:38:38 2011 : swapinfo

Re: How To Timestamp the KORN Shell History File

Alzhy — Thu, 19 May 2011 12:46:21 GMT

Wouldn't eksh (enhanced korn shell) also do the same with the added advantage of being able to capture to a syslog server or some WORM based storage?

Re: How To Timestamp the KORN Shell History File

Bill Hassell — Thu, 19 May 2011 13:15:38 GMT

> Wouldn't eksh (enhanced korn shell) also do the same ...

Sure. eksh is actually found on all HP-UX systems (optional on 11.31) but is named /usr/dt/bin/dtksh, also known as Korn shell version 1993. However, there will be a few incompatibilities, especially with poorly written scripts that do not have an interpreter line (that is #!/usr/bin/ksh or #!/bin/sh). ksh93 has a lot of nice features such as real (not just integer) numbers. Unfortunately, HP does not supply a general ksh93 man page but only documents the ksh93 Xwindow extensions. Here is a good reference:

www.kornshell.com/doc/ksh93.html

Re: How To Timestamp the KORN Shell History File

Shibin_2 — Wed, 25 May 2011 06:15:42 GMT

Found solution for AIX as well :)

All you have to do is, put the following line in .profile ( for global it can be in /etc/profile ).

EXTENDED_HISTORY=ON

To read the exact date & time of the command executed of a userâ s history file, use the following option.

env HISTFILE= /usr/bin/fc -t