topic Re: Command history in Operating System - HP-UX

Command history

Laszlo Csizmadia — Mon, 30 Jun 2003 13:36:21 GMT

Which is the best way to log every shell command on an HP-UX matchine?.
Sometimes it happens that a user did something and I want to see what commands he gave out from his terminal session but it's not listed in .sh_history or in similar file. Sometimes even happens that the history file is deleted.
A would appreciate any ideas...
Thanks.

Re: Command history

Hai Nguyen_1 — Mon, 30 Jun 2003 13:38:58 GMT

Laszlo,

Look into trusted system. I think you can audit a user's activities with it.

Hai

Re: Command history

John Meissner — Mon, 30 Jun 2003 13:39:12 GMT

you could put
script filename
in their .profile....

but this would capture all stdin stdout and stderr

you would have some large files on your system if you didn't clean them

Re: Command history

Umapathy S — Mon, 30 Jun 2003 13:49:51 GMT

Laszlo,
Check whether HISTFILE is exported for all users. If its not exported then you cannot see the command history in .sh_history file.

HTH,
Umapathy

Re: Command history

Robert-Jan Goossens — Mon, 30 Jun 2003 14:04:20 GMT

Hi,

# man lastcomm

If you activate accounting do not forget to check the size of /var even extend it.

Kind regards,

Robert-Jan.

Re: Command history

Jim Mallett — Mon, 30 Jun 2003 14:48:34 GMT

Check their profile to be sure the HIST variables are being exported.

You could have their HISTFILE go to a folder other than their default home folder, one that they don't have priviledges to delete like /var/adm. That will not keep them from editing the files if that is what you think is happening.

I think Auditing is your best bet.

Jim

Re: Command history

Rita C Workman — Mon, 30 Jun 2003 14:53:06 GMT

You can set your system to be a trusted system.
...and that means that everybody gets 'trusted'. So you can count a space being chewed up, and the need to review these files.

Or, you can look into a third party software that allows you to record everything a person or persons does on a toggle on/off basis. That way you don't get the all or nothing effect of a trusted system.
We went with PowerBroker from Symark. We use it for spot monitory/checking of folks, and use the tools to set up customized root permissions (and record the activity).

Cause everyone..needs choices,
Rgrds,
Rita

Re: Command history

Caesar_3 — Mon, 30 Jun 2003 20:08:55 GMT

Hello!

If you use trusted system it write all
what done in the system.
You can also use script command that will
save all what done in the prompt.

Caesar

Re: Command history

Bill Hassell — Mon, 30 Jun 2003 20:16:50 GMT

Assuming the users have the standard POSIX shell (or perhaps ksh), put this in your /etc/profile file:

export HISTFILE=$HOME/.sh_history

Just to be sure, create the shell history file in every user's directory. Assuming (again) that all users have their HOME in the /home directory, do this one time:

umask 077
export PATH=/usr/bin
for MYHOME in /home/*
do
MYUSER=$(basename $MYHOME)
touch $MYHOME/.sh_history
chown $MYUSER $HOME/.sh_history
done

Note that if the users are doing something complicated like running an Xwindow emulator and using CDE to manage their screens, there are more steps required.