Running history command from .cshrc

[Francis Crowe]

Hello,

I am not a csh user but have the following csh challenge to solve.

I need to capture a users command stack history for security reasons. Since I cannot guarantee the user will exit the shell with "exit" or "Ctrl-D" (user uses reflections, so will do "File:Exit") I therefore need to plant my programming logic in .cshrc or .login.

To this end I have tried two approaches:

1. Simply put the "history" command in .cshrc / .login and re-direct to a file. However the history command is not executed successfully during login. I have no idea why not...

2. I tried creating a simple csh shell script which I tried sourcing during login from .cshrc & .login

.
.
source $home/show_hist.csh <--- Last line in .login

virgo 50: cat show_hist.csh
#!/usr/bin/csh -f
history > histop

The script is sourced and executed but the file is always of zero size i.e. the "history" command fails to display the command stack. If I run the "history" command or my script from the shell after the login process completes they both work perfectly?

Any help appreciated!

Regards,
Francis.

[Jean-Louis Phelix]

Hi,

Same for me ... not really a csh user and history doesn't work. But why don't you simply append the content of ~/.history (the history file) to your archive ? Something like "cat ~/.history >> file" in users' .login files.

Regards.

[Gregory Fruth]

If you're doing this for security reasons perhaps you
should investigate auditing (man 5 audit) or accounting
(man 1m acct).

If those are not what you want, as an el-cheapo solution
try creating a wrapper around csh called csh.logged
which automatically captures the commands from the
history file, or uses "tee" or "script" to log everything.
(Note that this will grab the screen output as well.)

Then change the passwd file so that all users use
csh.logged as their login shell.

Of course, you'll have to prevent users from manually
invoking the real csh (or sh or ksh, for that matter --
which is a problem with your current solution as well).

HTH