topic need more teeth into .sh_history file in Operating System - HP-UX

need more teeth into .sh_history file

Jacob_2 — Thu, 25 Apr 2002 20:55:21 GMT

Hi,

How can I get Timestamp info into the .sh_history file?

thanks

Re: need more teeth into .sh_history file

someone_4 — Thu, 25 Apr 2002 21:12:13 GMT

Hi
Good question. The closest I have ever gotten was in the .profile add
date >> .sh_history
to the bottom line.
That will give you a time line per instance.Not per command.

Richard

Re: need more teeth into .sh_history file

Deepak Extross — Fri, 26 Apr 2002 00:48:23 GMT

Remember that messing with the sh_history file may hamper the ability to use 'history' commands like Esc-k, fc, r.
Also, each user ean edit his/her own sh_history file, so this may not be such a good place to look for adding more teeth.
If you really need tighter auditing, consider using BigBrother ( http://bb4.com/ )

Re: need more teeth into .sh_history file

Devbinder Singh Marway — Fri, 26 Apr 2002 10:25:22 GMT

you can have a history file for each user logged in i.e in the profile add
export HISTFILE=/tmp/.hist$$

laters

Re: need more teeth into .sh_history file

Paula J Frazer-Campbell — Fri, 26 Apr 2002 10:49:37 GMT

Hi

Add the following to .profile:-
--------------------------------
# Date stamp (When logged in) >> .sh_history
# Who logged in (From where)
date >> ~/.sh_history
who -u|grep root >> ~/.sh_history

-------------------------------
Change the grep to suit the user.

Entry in .sh_history will look like :-
----------------------------------
Mon Mar 19 17:21:19 GMT 2001
root pts/tDb Mar 19 17:21 . 1375 172.20.1.118
cd etc
cat passwd |grep avap
exit -----------------------------------

HTH

Paula

Re: need more teeth into .sh_history file

Jacob_2 — Fri, 26 Apr 2002 15:36:27 GMT

Hi,

What I needed is this
Entry in .sh_history should look like :-
----------------------------------

Mar 19 17:21:19 $PS1 cd etc
Mar 19 17:30:19 $PS1 cat passwd |grep avap

Re: need more teeth into .sh_history file

hpuxrox — Fri, 26 Apr 2002 15:42:46 GMT

To my knowlege, that can not be done by conventinal means.

Re: need more teeth into .sh_history file

Helen French — Fri, 26 Apr 2002 15:53:05 GMT

Hi Jacob:

I think you need to enable accounting in your system inorder to do this. This will keep track of each command, time, user, processes etc. See this for more details:

# man 1M acct

HTH,
Shiju

Re: need more teeth into .sh_history file

Gary Yu — Fri, 26 Apr 2002 18:45:20 GMT

a 'ugly' way to do this is to set a cronjob to run, say every 10 mins, just to insert time tag into .sh_history file:
date >> .sh_history

then you can have a rough idea which command was issued at when -- change cronjob frequency with your demand.

thanks,
Gary

Re: need more teeth into .sh_history file

Ed Sampson — Mon, 29 Apr 2002 17:48:06 GMT

I don't think there is a way to do it with the standard shells. You may be able to create a companion file with acctcom using the accounting info, but I would not try to merge them.

Re: need more teeth into .sh_history file

harry d brown jr — Mon, 29 Apr 2002 18:13:18 GMT

Have each user in each session maintain their own HISTory files:

readonly HISTFILE="${HOME}/.sh_history_`date +%y%m%d.%H%M%S`.$$"
readonly HISTSIZE=50000
export HISTFILE HISTSIZE

Of course you need to maintain them (DELETE them) after you have done what you wish to do with them.

live free or die
harry

Re: need more teeth into .sh_history file

Mladen Despic — Mon, 29 Apr 2002 18:58:54 GMT

I would suggest using 'print -s' instead of '>>'. For example, try this:

print -s `/sbin/date`
print -s `/usr/bin/who -um`

You can set these commands in users' .profile or in a script (to be executed by cron).

The point is that the standard output re-direction may corrupt your command line history mechanism.

If you want a timestamp on the same line with the command line, that may also corrupt your command line history mechanism.

For more information on 'print -s' do 'man sh-posix'

Re: need more teeth into .sh_history file

Jacob_2 — Tue, 30 Apr 2002 14:28:13 GMT

Thanks all,

I guess the only way would be turn on accounting.

Re: need more teeth into .sh_history file

Wodisch — Tue, 30 Apr 2002 15:59:49 GMT

Hi Jacob,

have you considered using "script"?
That way you can have the commmands AND their output in a logfile, and if you put the date&time into your prompt, you'll get what you asked for...

HTH,
Wodisch

Re: need more teeth into .sh_history file

Jacob_2 — Tue, 30 Apr 2002 16:46:10 GMT

Hi Wodisch,

I needed this to keep a track of user commands for any misbehaviour diagnosis or flaw detection..etc

And the format I was looking for is as below....Timestamp..Command (no output) & paths.

example.

Mar 19 17:21:19 $PS1 cd etc
Mar 19 17:30:19 $PS1 cat passwd |grep avap

Anyway , thanks for all the help.
As I said earlier I may have to look at accouting.

Jacob

Re: need more teeth into .sh_history file

hpuxrox — Tue, 30 Apr 2002 16:57:18 GMT

Maybe you could try putting the script command in /etc/profile.

script -a /audit/`id -un`.auditfile

Im sure these will fill up fast. So be sure to set some kind of auto log cleanup.

Re: need more teeth into .sh_history file

Pete Randall — Tue, 30 Apr 2002 17:08:20 GMT

Jacob,

How about adding the date command to their prompt?
As in:
export PS1="`date`(!)`whoami`# "
Put this in their .profile. If need be you can lock down write access to their .profile so they can't mess with it.

Pete

Re: need more teeth into .sh_history file

hpuxrox — Tue, 30 Apr 2002 17:10:20 GMT

ohhraa Pete! and then use the script command.

Re: need more teeth into .sh_history file

hpuxrox — Tue, 30 Apr 2002 17:13:03 GMT

Then if you wait to see it like a .sh_history
cat /audit/username.auditfile | grep "A_Key_Word_form_the_prompt"

Re: need more teeth into .sh_history file

Pete Randall — Tue, 30 Apr 2002 17:16:59 GMT

So brother Randall, is "ohhraa" a good thing? I'll hope so.