cancel
Showing results for 
Search instead for 
Did you mean: 

history record

asce
Occasional Advisor

history record

Hello,
I want to record in the system all users' operation, how do I need to do? Thanks!
8 REPLIES
rayche
Frequent Advisor

Re: history record

Under user's home direcory, there is .sh_history file, you can find operation history from that file
Michael Steele_2
Honored Contributor

Re: history record

Depends upon the shell. For ksh use HISTSIZE. I.e., in /home/user/.profile include:

export HISTSIZE=3000

HISTSIZE 3000 will record the last 3000 commands of the user. Default is about 100. To search type in 'history'. I.e.,

history -1000 | grep -i command
Support Fatherhood - Stop Family Law
Marek Mahut
Advisor

Re: history record

Hello,

you can define $HISTFILE variable in user profile file too.

For example:
export HISTFILE=/root/users_history/$USER.log
export HISTSIZE=900000000

and don't forget to set right permission for /root/users_history/


"If I ever find out about someone sacrificing quality in order to meet a shipment schedule, I will personally have him fired." -- Dave Packard
spex
Honored Contributor

Re: history record

Hello,

Under sh-posix and ksh, command history is saved to ~/.sh_history by default. To see the complete history for all users:

# more /home/*/.sh_history

To see the last ten commands entered by all users:

# find /home -name .sh_history -exec tail -n 10 {} \;

Set $HISTSIZE=5000 in each user's ~/.profile to keep a large command history for each user.

PCS
Geoff Wild
Honored Contributor

Re: history record

If you expect to have a total record - you can't.

Though if you convert to a trusted system, you can turn on auditing.

With .sh_history - users can delete it whenever they like.

Rgds...Geoff
Proverbs 3:5,6 Trust in the Lord with all your heart and lean not on your own understanding; in all your ways acknowledge him, and he will make all your paths straight.
spex
Honored Contributor

Re: history record

Hi,

Read up on the 'script' command, which makes a typescript of everything on the terminal. You could add the following to /etc/profile:

# script -a /tmp/scr-$(whoami).log

If you modify your users' $PS1 prompt to display the current date/time, items in your typescript will be timestamped.

PCS
Marvin Strong
Honored Contributor

Re: history record

Shell histories are ok, but as stated a user can clear it out whenever they want. The only way would be with auditing, and If you are recording everything users do, I suspect you are going to need a decent sized disk, depending on how long you plan to keep the logs.

asce
Occasional Advisor

Re: history record

thanks!