history record

[asce]

Hello，
I want to record in the system all users' operation, how do I need to do? Thanks！

[rayche]

Under user's home direcory, there is .sh_history file, you can find operation history from that file

[Michael Steele_2]

Depends upon the shell. For ksh use HISTSIZE. I.e., in /home/user/.profile include:

export HISTSIZE=3000

HISTSIZE 3000 will record the last 3000 commands of the user. Default is about 100. To search type in 'history'. I.e.,

history -1000 | grep -i command

[Marek Mahut]

Hello,

you can define $HISTFILE variable in user profile file too.

For example:
export HISTFILE=/root/users_history/$USER.log
export HISTSIZE=900000000

and don't forget to set right permission for /root/users_history/

[spex]

Hello,

Under sh-posix and ksh, command history is saved to ~/.sh_history by default. To see the complete history for all users:

# more /home/*/.sh_history

To see the last ten commands entered by all users:

# find /home -name .sh_history -exec tail -n 10 {} \;

Set $HISTSIZE=5000 in each user's ~/.profile to keep a large command history for each user.

PCS

[Geoff Wild]

If you expect to have a total record - you can't.

Though if you convert to a trusted system, you can turn on auditing.

With .sh_history - users can delete it whenever they like.

Rgds...Geoff

[spex]

Hi,

Read up on the 'script' command, which makes a typescript of everything on the terminal. You could add the following to /etc/profile:

# script -a /tmp/scr-$(whoami).log

If you modify your users' $PS1 prompt to display the current date/time, items in your typescript will be timestamped.

PCS

[Marvin Strong]

Shell histories are ok, but as stated a user can clear it out whenever they want. The only way would be with auditing, and If you are recording everything users do, I suspect you are going to need a decent sized disk, depending on how long you plan to keep the logs.

[asce]

thanks!