Command history

[Laszlo Csizmadia]

Which is the best way to log every shell command on an HP-UX matchine?.
Sometimes it happens that a user did something and I want to see what commands he gave out from his terminal session but it's not listed in .sh_history or in similar file. Sometimes even happens that the history file is deleted.
A would appreciate any ideas...
Thanks.

[Hai Nguyen_1]

Laszlo,

Look into trusted system. I think you can audit a user's activities with it.

Hai

[John Meissner]

you could put
script filename
in their .profile....

but this would capture all stdin stdout and stderr

you would have some large files on your system if you didn't clean them

[Umapathy S]

Laszlo,
Check whether HISTFILE is exported for all users. If its not exported then you cannot see the command history in .sh_history file.

HTH,
Umapathy

[Robert-Jan Goossens]

Hi,

# man lastcomm

If you activate accounting do not forget to check the size of /var even extend it.

Kind regards,

Robert-Jan.

[Jim Mallett]

Check their profile to be sure the HIST variables are being exported.

You could have their HISTFILE go to a folder other than their default home folder, one that they don't have priviledges to delete like /var/adm. That will not keep them from editing the files if that is what you think is happening.

I think Auditing is your best bet.

Jim

[Rita C Workman]

You can set your system to be a trusted system.
...and that means that everybody gets 'trusted'. So you can count a space being chewed up, and the need to review these files.

Or, you can look into a third party software that allows you to record everything a person or persons does on a toggle on/off basis. That way you don't get the all or nothing effect of a trusted system.
We went with PowerBroker from Symark. We use it for spot monitory/checking of folks, and use the tools to set up customized root permissions (and record the activity).

Cause everyone..needs choices,
Rgrds,
Rita

[Caesar_3]

Hello!

If you use trusted system it write all
what done in the system.
You can also use script command that will
save all what done in the prompt.

Caesar

[Bill Hassell]

Assuming the users have the standard POSIX shell (or perhaps ksh), put this in your /etc/profile file:

export HISTFILE=$HOME/.sh_history

Just to be sure, create the shell history file in every user's directory. Assuming (again) that all users have their HOME in the /home directory, do this one time:

umask 077
export PATH=/usr/bin
for MYHOME in /home/*
do
MYUSER=$(basename $MYHOME)
touch $MYHOME/.sh_history
chown $MYUSER $HOME/.sh_history
done

Note that if the users are doing something complicated like running an Xwindow emulator and using CDE to manage their screens, there are more steps required.