Tracking rm and/or .sh_history

[TheJuiceman]

Is there a way to script something to track all rm, redirects, mv ... any command that could delete or change a file? What about getting .sh_history if it is altered with?

Thanks.

[Cheryl Griffin · Accepted solution]

See Bill's response (Nov 27, 2001 21:40:52) in
http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=113459

[Vibhor Kumar Agarwal]

One more option,

Just write the command
script logfile
in .profile of all users.

Not all that the users will write will go into that logfile.

[Muthukumar_5]

You can put a script in /etc/profile for generating history of separarte users as like,

# Create a directory like,
mkdir /var/history

-- /etc/profile --
set -o $EDITOR
export HISTFILE=/var/history/.history_${LOGNAME}
export HISTSIZE=1000

Another way,
you have to put shell wrapper for generating individual logs for rm, mv commands. Like cd command in,
http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=939679
write a wrapper for yours.

hth.