Check Users's command and time(ip)

[Byun Hee Joong]

Is it possible to put IP Address or TIME(when user type the command)
in history file(.sh_history)

Because I'd like to check
multiple users's action and time(ip).

If it is not possible
let me know another method.
shell is O.K.

thanks~

[Alessandro Pilati]

Put in the .profile the following setting:

HISTFILE=/tmp/`who -u am i|awk '{ print $1"_"$8"_"$2 }'|sed 's/\///g'`.hist
So you will get, for each user that logs in the server, separate history files under /tmp
( foe example: /tmp/root_10.115.0.3_pts0.hist )

Regards,
Alex

[Mauro Gatti]

Pheraphs you can find usefull to bring your system in trusted mode.
You will have importatn additional security features such as auditing or access restrictions (terminal, time and serial) you could use.

RGDS

[Kent Ostby]

THe auditing subsystems as well as the use of ACls will help you control the behaviour of and monitor your users.

Oz

[Alessandro Pilati]

Byun,
this is an integration fo my previous reply:
don't forget the following line at the end of .profile:
export HISTFILE

Regards,
Alex

[Muthukumar_5 · Accepted solution]

We can not add time or ip-address into .sh_history file . To suggest another method,

you can start new history file every IP-Address with time details as,

-- /etc/profile --
$HISTFILE=/var/history/.sh_history_$(who -mu | awk '{ print $NF }'

echo "$LOGNAME is logged @ $(date +'%d_%m_%y')"

---

It will create HISTFILE for every IP-Address and update time of starting session in the history file.

hth.