How To Timestamp the KORN Shell History File

[Michael Steele_2]

To Whom It May Concern:

If your like me and you've been looking for the BASH 'HISTTIMEFORMAT' equivalent for HPUX KSH, well, here it is and I think this is what your E&Y auditors will be happy to see.
####################################
My .profile File
> cat .profile
set -u # error if undefined variable.
trap "echo 'logout root'" 0 # what to do on exit.
trap 'date "+#%c" | read -s' debug # timestamp .sh_history
export HISTFILE=/tmp/$LOGNAME`date +%m%d%y%H%M%S` # Put it in /tmp

My .sh_history file
AKA /tmp/$LOGNAME030911134105

> cat /tmp/f808636030911134105

trap 'date "+# %c" | read -s' debug
# Wed Mar 9 13:42:24 2011
'date "+# %c"'
# Wed Mar 9 13:42:35 2011
history
# Wed Mar 9 13:42:45 2011
trap 'date "+# %c" | read -s' debug
# Wed Mar 9 13:43:02 2011
hisot
# Wed Mar 9 13:43:38 2011
thi
# Wed Mar 9 13:46:14 2011
history
# Wed Mar 9 13:46:16 2011
dog
# Wed Mar 9 13:46:55 2011
cat
ls -la
# Wed Mar 9 13:47:03 2011
cat /etc/passwd
# Wed Mar 9 13:47:09 2011
history
# Wed Mar 9 13:47:12 2011
cat /etc/group
# Wed Mar 9 13:48:34 2011
history
# Wed Mar 9 13:48:36 2011
cat /etc/fstab
# Wed Mar 9 13:48:43 2011
history
# Wed Mar 9 13:48:45 2011
vgdisplay
# Wed Mar 9 13:48:53 2011
history
# Wed Mar 9 13:48:57 2011
vi .profile
# Wed Mar 9 13:50:25 2011
id
# Wed Mar 9 13:50:28 2011
ps
# Wed Mar 9 13:50:29 2011
exit
# Wed Mar 9 13:50:30 2011

[Shibin_2]

Good to see. Unfortunately, when I tried the option, got the following error:

DEBUG : Max recursion reached it's limit, exiting

I am unable to login. :(

[Steven Schweda]

> [...] your E&Y auditors will be happy to see.

> [...] # Put it in /tmp

So, anyone can play with it? How happy does
that keep everyone?

[Michael Steele_2]

Shibin:
That's interesting. Well if nothing ever worked then you've missed something but if you're saying it worked for awhile and then bombed then its of no use. I'll see if I can recreate the same.
Thanks!




Steven:
Please get back on your Thorazine medication and remember to take your afternoon nappy poo. You'll feel better.

[Michael Steele_2]

Shibin:

Hey, I've run this now all morning with multiple sessions in root on both pa-risc 11.23 and ia64 11.23 and see none of what you are reporting.

?

[Steven E. Protter · Accepted solution]

I think this is a great addition.

Thanks.

I will play with it in the lab. Hopefully next week.

SEP

[Bill Hassell]

Here's a slight mod that makes the history a bit easier to read (YYYYMMDD.HHMMSS):

# trap 'date "+ # %a %Y%m%d.%H%M%S" | read -s' debug
5089 # Thu 20110310.202507
5090 ls
5091 # Thu 20110310.202509
5092 date
5093 # Thu 20110310.202510
5094 bdfmegs
5095 # Thu 20110310.202513
5096 boiotinfo
5097 # Thu 20110310.202514

Now the commands are visible on the left with the timestamps pushed to the right. This is the only line you'll need for .profile to add timestamps to each line in the shell history file. Thanks for posting this technique Michael.

[Shibin_2]

Michael,

Thanks. I have tested it in another PA RISC, works fine. I hope I can use the same in my AIX machine :) .

Not sure, what happened to the earlier machine. I have to boot into single user mode to recover that now. ( tested in root user .. he he ).

[Hakki Aydin Ucar]

I used HP-UX 11iv1 PA-Risc box and worked good, great workaround!

[Michael Steele_2]

Yes. I like this better.

-/root> grep trap .profile

trap 'date "+ #%c" | read -s' debug # timestamp .sh_history

Thanks Bill Hassell.

-/root> history
389 # Fri 20110311.081338
390 # Fri 20110311.081338
391 history
392 # Fri 20110311.081341
393 history
394 # Fri 20110311.081346
395 # Fri 20110311.081354
396 history
397 vi .profile
398 . ./.profile
399 #Fri Mar 11 08:14:35 2011
400 #Fri Mar 11 08:14:35 2011
401 #Fri Mar 11 08:14:35 2011
402 #Fri Mar 11 08:14:35 2011
403 #Fri Mar 11 08:14:35 2011
404 history
root@fxgpq506-/root>

[Hakki Aydin Ucar]

Bill' s addendum looks good.

Micheal;
the only thing I noticed that after exit root, history was being cleaned.
But you keep records under /tmp already,
so the second step I wonder if time stamp can be in same line with the command we issued ?

[Michael Steele_2]

Hakki:

"...regarding the only thing after exit root has been cleaned..." - This has been the latest security recommendation unless you've got auditors like I have and they want time stamps on every root command.

Anyway Hakki, this is why I put this command in:

trap "echo 'logout root'" 0 # what to do on exit.

...you didn't read the whole posting.

As for having the time stamp on the same line as the command as well as the line number, i.e.,

2Wed Mar 9 13:50:29 2011 ps
3Wed Mar 9 13:50:30 2011 exit

....is the BASH / HISTTIMEFORMAT method that I was looking to reproduce for auditing purposes and have not been able to.

But if you do please let me know. Thanks!

[Steven E. Protter]

Shalom,

No points, not fishing.

I tried it out in the lab. The Bill Hassell modification is working.

I'd say as far as figuring out who did what to a system when, this could be useful, though obviously it increases the size of logs.

We probably have some collection procedure in place and I'm worried some kind of SOX report might get unhappy with this hack.

Still, its a great hack.

SEP

[Shibin_2]

AIX Korn shell trapped me.

It's giving me the same error

"DEBUG : Max recursion reached it's limit, exiting"

Unable to login. I tried different signals, but no time stamp records. Could it be related to any kernel parameter ? Any AIX gurus here ?

[Hakki Aydin Ucar]

>Michael: But if you do please let me know. Thanks!

Michael, I couldn't go further but I found that ,are you aware of the parameter EXTENDED_HISTORY in korn shell, I coukdn't find in my environment but if you check this out:

To start recording the date and time that each command is executed, set the EXTENDED_HISTORY environment variable to ON:
export EXTENDED_HISTORY=ON
The CUT (Coordinated Universal Time) timestamp will be appended
to each line of the ~/.sh_history file.

[broken link removed on <4/12/2017> by Mod] 

[Shibin_2]

Hakki,

I tested it in my AIX and HP-UX servers.

HP-UX .. no luck. It's not recording any time stamps.

But AIX, it records, but very difficult to identify what is the exact date and time (see below). :)

ls -la #Ã #1300259962#Ã #
tail .sh_history #Ã #1300259975#Ã #

HP-UX 11.23 PA-RISC
AIX P570 6.1

I think, it is depends on the ksh version we use.

[Hakki Aydin Ucar]

if you are not consider security issue ,here is my workaround solution, at the end of the .profile ;

# cat /.profile
...
## timestamp to history file ..
set -u # error if undefined variable.
trap 'date "+%c" | read -s' debug # timestamp .sh_history


# cat /tmp/hist_reader
#!/bin/sh
# reader for ksh history from current with timestamp

ADDRESS="$HOME/.sh_history"
cat $ADDRESS >> /tmp/temporal
sed 'N;s/\n/\ : /' < /tmp/temporal

Result:
# /tmp/hist_reader
Tue May 3 15:32:43 2011 : bdf
Tue May 3 15:32:45 2011 : Bpsm
Tue May 3 15:32:48 2011 : pwd
Tue May 3 15:32:52 2011 : history
Tue May 3 15:32:55 2011 : ./
Tue May 3 15:33:05 2011 : ls
Tue May 3 15:33:25 2011 : cat /.profile
Tue May 3 15:36:37 2011 : pwd
Tue May 3 15:37:47 2011 : ls
Tue May 3 15:38:31 2011 : uptime
Tue May 3 15:38:38 2011 : swapinfo

[Alzhy]

Wouldn't eksh (enhanced korn shell) also do the same with the added advantage of being able to capture to a syslog server or some WORM based storage?

[Bill Hassell]

> Wouldn't eksh (enhanced korn shell) also do the same ...

Sure. eksh is actually found on all HP-UX systems (optional on 11.31) but is named /usr/dt/bin/dtksh, also known as Korn shell version 1993. However, there will be a few incompatibilities, especially with poorly written scripts that do not have an interpreter line (that is #!/usr/bin/ksh or #!/bin/sh). ksh93 has a lot of nice features such as real (not just integer) numbers. Unfortunately, HP does not supply a general ksh93 man page but only documents the ksh93 Xwindow extensions. Here is a good reference:

www.kornshell.com/doc/ksh93.html

[Shibin_2]

Found solution for AIX as well :)

All you have to do is, put the following line in .profile ( for global it can be in /etc/profile ).

EXTENDED_HISTORY=ON

To read the exact date & time of the command executed of a userâ s history file, use the following option.

env HISTFILE= /usr/bin/fc -t

[Alzhy]

Coz it likely uses eKSH.

On most of my clients, I use the eKSH -- built specifically from source.

It logs to multiple syslogs as well as to a WORM device.

We also strictly enforce "sudo -s -E" with the root account and Consoles equally secured as well.

[Kevin_Bartley]

Not sure if people are still looking at this thread ... but I'll give it a shot!

I tried to implement these recommendations on our system (running RHEL5.7), but I see strange results.  Any command that contains a '|' in it seems to be treated as a 'job' ... I can run multiple commands like this, then when I hit just a <CR> at the prompt, I see a bunch of "completed jobs" messages like the following:

mylogin@mymachine: ps -fumylogin | grep imsmeta
mylogin       25371     1  0 Feb14 pts/0    00:00:00 imsmeta_server -i 960 -A -- -d 1
mylogin       25375     1  0 Feb14 pts/0    00:00:00 imsmeta_server -i 961 -A -- -d 1
mylogin       25479 25035  0 21:23 pts/2    00:00:00 grep imsmeta
mylogin@mymachine: ps -fumylogin | grep wmmon

mylogin       25365     1  0 Feb14 pts/0    00:00:51 wmmon_server -i 480 -A -e /mydir/bin/stderr.wmmon_server --
mylogin       25411 25107  0 Feb14 ?        00:00:00 wmmon_client -i 1
mylogin       25487 25035  0 21:23 pts/2    00:00:00 grep wmmon
mylogin@mymachine: ps -fumylogin | grep ksh
mylogin       24217 24214  0 21:06 pts/1    00:00:00 -ksh
mylogin       25035 25033  0 21:17 pts/2    00:00:00 -ksh
mylogin       28294 28290  0 Feb14 pts/0    00:00:00 -ksh
mylogin@mymachine: date | awk ' { print $2 } '
Feb
mylogin@mymachine: ps -fumylogin | grep ksh
mylogin       24217 24214  0 21:06 pts/1    00:00:00 -ksh
mylogin       25035 25033  0 21:17 pts/2    00:00:00 -ksh
mylogin       25517 25035  0 21:24 pts/2    00:00:00 grep ksh
mylogin       28294 28290  0 Feb14 pts/0    00:00:00 -ksh
mylogin@mymachine: <Enter>
[6] +  Done                    ps -fumylogin | grep ksh
[5] -  Done                    date | awk ' { print $2 } '
[4]    Done                    ps -fufuommylogin | grep ksh
[3]    Done                    ps -fumylogin | grep wmmon
[2]    Done                    ps -fumylogin | grep imsmeta
mylogin@mymachine:

Any ideas why this would happen?  The entry in my .profile is as follows:

tty >/dev/null 2>&1 && trap 'date "+# %D %T" | read -s' debug

We added the 'tty >/dev/null 2>&1 &&' to the trap line because we were seeing many date-only lines in the history file, and they appeared to be tied to cron jobs that were running.

Any thoughts?

Kevin

[Navin1]

when i execute below code , i am getting error called memory fault (core dump)

         set -u
         trap '/bin/date "+#%c" | read -s' debug  

[Dennis Handly]

>getting error called memory fault (core dump)

What does "file core" say?

What does gdb stacktrace show?

(Replace ksh below by the path to your shell.)

gdb /usr/bin/ksh core

(gdb) bt

(gdb) q

[Navin1]

in our system , using debug and trap its causing core dump,

due to some dependencies, is there any other method to achieve

this ??
because i even tries with using PS1 variable, but in our system environment we are already using PS1,

any other mwthod available ?