Maintaining log for command being type on workstation

[Henry Chua]

Hi Guys,

I was just wondering, is it possible to maintain a log of all command being type on a workstation. Even from remote login?

Thanks

Henry

[Bill Hassell]

If you setup the shell variable HISTFILE in .profile, then commands will be logged. Note that only commands will be logged, not the interaction with the command itself such as vi (you won't see what was typed in vi). Put this in .profile:

export HISTFILE=$HOME/.sh_history

The user commands will be in the .sh_history file. Now the above line assumes several things: the standard shell /usr/bin/sh, and the user actually logs in using something like telnet or rlogin. For non-standard shells like csh, a single command such as remsh, or non-standard connections such as CDE, there are diferent or additional steps.

Now to log everything including interaction with other programs, you can use the script command.

[Henry Chua]

Hi Bill,

Thanks for the reply. Will this data be flushed whenever i logged off? Is there a way to prevent this. And is there a way to include a time stamp on when each command have been executed?

Regards
Henry

[Devender Khatana]

Hi,

The data in history file will not be removed when logging off.

Putting a time stamp for each file is not possible with this.

Script command can also be used to achive this for a particular session. script also has -a option to append to previous file.

HTH,
Devender

[morganelan]

You must set two shell variables HISTFILE and HISTSIZE to maintain history of your commands that have been executed on your HPUX Machine.
The history file specified by HISTFILE contains the latest commands you executed at your terminal. Every time you type a command at the prompt and press Return it is stored in this history file. HISTSIZE specifies the maximum number of commands stored in that file. For example:

HISTFILE=/users/test/.history
HISTSIZE=100

If you do not set these two variables in your .profile, the shell defaults to a file named .sh_history of 128 lines.

The history mechanism keeps continuous record of the most recent commands you have executed, even if you log out and back into the system many times or execute the commands in a subshell.

[Vibhor Kumar Agarwal]

I'll say go by the "script" option.

Becasue with history, if you exceed the size, the older commands will be overwritten.

Further script will give you more detail output.

[Joseph Loo]

hi,

do for:

each users:
# vi ~/.profile
insert -->
export HISTSIZE=1000
export HISTFILE=/.sh_history

the thing with .sh_history in each user profile is that they may amend that file as well.

if it is for auditing purpose, convert to trusted and turn auditing on.

regards.

[Arunvijai_4]

Hi Henry,

A similar thread you might want to look at it,

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=957735

-Arun

[Muthukumar_5]

Setup history enablement in your shell if you want to log command being typed as,

--- /etc/profile ---

set -o vi
export HISTFILE=/tmp/history_${LOGNAME}_$(date +'%d-%m-%y')
export HISTSIZE=2000

You can change HISTFILE setting.

hth.

[Edgar_8]

Hi Henry,

I would suggest the following change to the .profile file:

TTY=$(tty)
TTYBASE=$(basename $TTY)
stty erase ^?
export HISTFILE=/.sh_history/$TTYBASE

This will create a new history file based on terminal.

hth

[Raj D.]

Hi Henry ,

You need to add script in .profile script.

You can log all the session commands including session output with following:

1. In each user .profile , add the script command , So it will generate all the details of their session , with the file name.

Remember it will need additional space.
Line to add:


script $HOME/log/`whoami`.`date +%d%m%y"."%T`

So the file will have complete log of the user at that session , and close the log when he/she will logoff.. For details see: # man script.

Cheers,
Raj.

[Raj D.]

Henry ,

Little correction :

Check this out :

$ mkdir $HOME/log
$ script "$HOME/log/`whoami`.`date +%d%m%y"."%T"


Dont cat the output file .., you can check from another session.

Enjoy,
Cheers,
Raj.

[Muthukumar_5]

If you are going to try with script command then be aware disk usage. It will use more disk space that it gathers all typed command and results also.

It is better to keep history level itself when you are bothering about disk space also.

hth.

[Marlou Everson]

Henry,

You may want to look at this thread (Is there a way to timestamp commnd history) for including a timestamp with the command.

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=896650


Marlou