How to log down all commands silently?

[Kenny Chau]

I want to log down all the commands that was entered but I did not want to let others know that I am logging down what they had done. I know that "script" command can log down but it displays the messages at the beginning and then end that start and stop logging and that is not I want. I had also tried to use "tee" command but it only displayed the output without the command that I type. So please tell me how to log down the commands without letting others know. Thanks very much.

[Thierry Poels_1]

Hi,
if you are only interested in the commands they fire from the shell prompt you could have a look in their history file ($HOME/.sh_history)
good luck,
Thierry.

[Philip Chan_1]

I don't know the answer but got an idea.

Found the source of a shell program, modify it such that all entered commands will be logged to a file, at last replace login shell of your target users with this modified shell program.

~Philip

[Kenny Chau]

Thanks for your reply, but I want to log down both the commands and output toggether in the same log file so that I can trace any problem.

[Paula J Frazer-Campbell]

Hi

You could write a false shell for this in that the false shell presents what appears to be a normal prompt, the users command is then piped to a log, actioned - logged and then displayed back to the user.


Paula

[Stefan Schulz]

I think the problem is where to start and where to stop. If you really want to log everything i would suggest creating your own shell. Go for the source of the shell you like and modify it to you needs.

But this wil produce a lot of data in your logfiles. If you do it right and a user opens a big file in vi this whole file will be in your log. And i doubt that this will make the logfiles usefull for you.

So i would suggest using the users historyfile for logging. This will give you a pretty good impression what a user does. To maintain these logfiles on a seperate place how about using tee -f on the users histroy? Doing so you wouldnt miss a single command and the user should not recognize he is beeing watched.

Hope this helps. Stefan

[Vincenzo Restuccia]

Edit in .profile script -a /tmp/log.

[Petr Drobny]

Hi, I guess, that logging on terminal-emulator level could help You. When You spawn terminal-emulator X11 window, you can type log parameters - on example: hpterm ... -l -lf "log_file_name" ...
or xterm ... etc. This will be log all input and output to shell and all, what will be send to terminal window. (Log-file system saves in 8kB buffer blocks).

[Jim Mulshine]

There is a problem with using the script command for logging a users commands and output. If the user types "cat file" where file is the script commands destination file, script logs the output of cat to its log. This can result in the destination file growing very rapidly and perhaps filling the disk. Try it.

[Steven Sim Kok Leong]

Hi,

man runacct and acctcom.

Once runacct is performed, commands performed by each user are logged in the background and they can be filtered and displayed via acctcom.

There are also other accounting commands that you can use for various purposes such as connection accounting and disk usage accounting etc.

Hope this helps. Regards.

Steven Sim Kok Leong
Brainbench MVP for Unix Admin
http://www.brainbench.com

[Kenny Chau]

Thanks for all your reply. I apologise that I did not state my situation clear. Sorry about that. In fact, I had written a menu for the operators to run command. However, in critical situation, they need to use the root command prompt which I already made. In this case, I want to log down what they had entered and the output together to a log file so that I can trace the problem. However, I don't want them to know that I am viewing what they entered. The script command will show the log begins and the log file name and this is the one that I don't want. I had tried to use the "tee logfile" command but it only logs down the output, you know, some commands will not have output, eg. compress or uncompress. So I want to log down the commands together with the output. Some replies said that I can write my own shell, but how? Can anyone tell me? Thanks very much for your help.

[Philip Chan_1]

Hmm.... in your case "sudo" may help, take a look at the following link

http://www.courtesan.com/sudo/

In summary what sudo does is that it allow an ordinary user to execute commands on behalf of the root user. In addition you could pre-define command set for the operators and all commands executed by them will be logged in the /var/adm/syslog/syslog.log file.

Rgds,
Philip

[Kenny Chau]

Thanks for your reply. Is it possible to use existing commands to finish this task? I had even tried to use 3>&2 / 2>&1 / 1>&3, etc to log down the commands and output but failed. Hope someone can help me. Thanks.

[Vincenzo Restuccia]

You can use 2>&1.

[Kenny Chau]

I had tried 2>&1 before, but no output display, also, only log down the output but not the input commands.

[Steven Sim Kok Leong]

Hi,

Install and use Expect.

Using a script such as the following allow you to log both the commands as well as the output (while running in a korn shell) into a log file called /traces/logfile.
==
#!/usr/local/bin/expect

log_user 0
log_file /traces/logfile
spawn "/usr/bin/ksh"
interact
==

Hope this helps. Regards.

Steven Sim Kok Leong
Brainbench MVP for Unix Admin
http://www.brainbench.com

[Steven Sim Kok Leong]

Hi,

I forgot to mention that by using the Expect script, you eliminate the problem you encounter while using the "script" command ie. "The script command will show the log begins and the log file name and this is the one that I don't want."

Hope this helps. Regards.

Steven Sim Kok Leong
Brainbench MVP for Unix Admin
http://www.brainbench.com

[Jim Moffitt_1]

Kenny, you had the right idea with the tee command. Use this with sudo and you will have total accountability and the output that you need put into a log and in a separate log, that you can specify you will have your sudo log of all commands.

[Kenny Chau]

Thanks for your reply. But is it possible to use existing commands to complete this task?