need more teeth into .sh_history file

[Jacob_2]

Hi,

How can I get Timestamp info into the .sh_history file?

thanks

[someone_4]

Hi
Good question. The closest I have ever gotten was in the .profile add
date >> .sh_history
to the bottom line.
That will give you a time line per instance.Not per command.

Richard

[Deepak Extross]

Remember that messing with the sh_history file may hamper the ability to use 'history' commands like Esc-k, fc, r.
Also, each user ean edit his/her own sh_history file, so this may not be such a good place to look for adding more teeth.
If you really need tighter auditing, consider using BigBrother ( http://bb4.com/ )

[Devbinder Singh Marway]

you can have a history file for each user logged in i.e in the profile add
export HISTFILE=/tmp/.hist$$

laters

[Paula J Frazer-Campbell · Accepted solution]

Hi

Add the following to .profile:-
--------------------------------
# Date stamp (When logged in) >> .sh_history
# Who logged in (From where)
date >> ~/.sh_history
who -u|grep root >> ~/.sh_history

-------------------------------
Change the grep to suit the user.


Entry in .sh_history will look like :-
----------------------------------
Mon Mar 19 17:21:19 GMT 2001
root pts/tDb Mar 19 17:21 . 1375 172.20.1.118
cd etc
cat passwd |grep avap
exit -----------------------------------

HTH

Paula

[Jacob_2]

Hi,

What I needed is this
Entry in .sh_history should look like :-
----------------------------------

Mar 19 17:21:19 $PS1 cd etc
Mar 19 17:30:19 $PS1 cat passwd |grep avap

[hpuxrox]

To my knowlege, that can not be done by conventinal means.

[Helen French]

Hi Jacob:

I think you need to enable accounting in your system inorder to do this. This will keep track of each command, time, user, processes etc. See this for more details:

# man 1M acct

HTH,
Shiju

[Gary Yu]

a 'ugly' way to do this is to set a cronjob to run, say every 10 mins, just to insert time tag into .sh_history file:
date >> .sh_history

then you can have a rough idea which command was issued at when -- change cronjob frequency with your demand.

thanks,
Gary

[Ed Sampson]

I don't think there is a way to do it with the standard shells. You may be able to create a companion file with acctcom using the accounting info, but I would not try to merge them.

[harry d brown jr]

Have each user in each session maintain their own HISTory files:


readonly HISTFILE="${HOME}/.sh_history_`date +%y%m%d.%H%M%S`.$$"
readonly HISTSIZE=50000
export HISTFILE HISTSIZE

Of course you need to maintain them (DELETE them) after you have done what you wish to do with them.


live free or die
harry

[Mladen Despic]

I would suggest using 'print -s' instead of '>>'. For example, try this:

print -s `/sbin/date`
print -s `/usr/bin/who -um`

You can set these commands in users' .profile or in a script (to be executed by cron).

The point is that the standard output re-direction may corrupt your command line history mechanism.

If you want a timestamp on the same line with the command line, that may also corrupt your command line history mechanism.

For more information on 'print -s' do 'man sh-posix'

[Jacob_2]

Thanks all,

I guess the only way would be turn on accounting.

[Wodisch]

Hi Jacob,

have you considered using "script"?
That way you can have the commmands AND their output in a logfile, and if you put the date&time into your prompt, you'll get what you asked for...

HTH,
Wodisch

[Jacob_2]

Hi Wodisch,

I needed this to keep a track of user commands for any misbehaviour diagnosis or flaw detection..etc

And the format I was looking for is as below....Timestamp..Command (no output) & paths.

example.

Mar 19 17:21:19 $PS1 cd etc
Mar 19 17:30:19 $PS1 cat passwd |grep avap


Anyway , thanks for all the help.
As I said earlier I may have to look at accouting.

Jacob

[hpuxrox]

Maybe you could try putting the script command in /etc/profile.

script -a /audit/`id -un`.auditfile

Im sure these will fill up fast. So be sure to set some kind of auto log cleanup.

[Pete Randall]

Jacob,

How about adding the date command to their prompt?
As in:
export PS1="`date`(!)`whoami`# "
Put this in their .profile. If need be you can lock down write access to their .profile so they can't mess with it.

Pete

[hpuxrox]

ohhraa Pete! and then use the script command.

[hpuxrox]

Then if you wait to see it like a .sh_history
cat /audit/username.auditfile | grep "A_Key_Word_form_the_prompt"

[Pete Randall]

So brother Randall, is "ohhraa" a good thing? I'll hope so.

[hpuxrox]

Just a saying among us fellow devildogs.....

[Pete Randall]

Like "Semper Fi"?

Pete