History file

[ken casazza_1]

We want to monitor 6 accounts' history files, so I have a tail -f running in the background for each .sh_history file. The problem is this: when one of the users types "> .sh_history", my tail -f stops displaying their subsequent commands, and I have to kill the first tail -f, and start another. Is there a better way for me to securely have a list of all their commands?
Thanks!

[Sanjay_6]

Hi Ken,

Don't see any choice over there. If the users does a /dev/null >$USER_HOME/.sh_history it will wipe out the .sh_history and make it size as zero.

Hope this helps.

thanks

[linuxfan]

Hi Ken,

An option is to use tee

tail -f ~user/.sh_history | tee /tmp/user.sh_history

This would tail the .sh_history file and copy that to /tmp/user.sh_history also.

Whenever a user issues a >.sh_history you will have to Ctrl-C your session where you are doing a tail -f but you will still have the commands listing in /tmp/user.sh_history file.


-HTH
Ramesh

[Bernie Vande Griend]

You could also try a different tact.
You could use the "script" command sucha s "script somefilename" and place it in their .profile. Then any commands and their output that user types will go to "somefilename". You can then tail -f that if you want.

[Wodisch]

Hello Ken,

make their history a link to some "save" dir
and set the "t" bit on their home dirs...
Own the link as "root", so they cannot remove
or rename it...

Just my ?0.02,
Wodisch

[ken casazza_1]

Thank you all for your assistance!!