- Community Home
- >
- Servers and Operating Systems
- >
- Operating Systems
- >
- Operating System - HP-UX
- >
- .sh_history getting trimmed by itself ? Why ?
Categories
Company
Local Language
Forums
Discussions
Forums
- Data Protection and Retention
- Entry Storage Systems
- Legacy
- Midrange and Enterprise Storage
- Storage Networking
- HPE Nimble Storage
Discussions
Discussions
Discussions
Forums
Forums
Discussions
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
- BladeSystem Infrastructure and Application Solutions
- Appliance Servers
- Alpha Servers
- BackOffice Products
- Internet Products
- HPE 9000 and HPE e3000 Servers
- Networking
- Netservers
- Secure OS Software for Linux
- Server Management (Insight Manager 7)
- Windows Server 2003
- Operating System - Tru64 Unix
- ProLiant Deployment and Provisioning
- Linux-Based Community / Regional
- Microsoft System Center Integration
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Community
Resources
Forums
Blogs
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Printer Friendly Page
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО09-15-2005 05:06 AM
тАО09-15-2005 05:06 AM
root .profile has value set very high (see below)
=====================================
HISTFILE=/root/.sh_history ; export HISTFILE
print -s "LOGIN - `date '+%m-%d-%E-%H:%M'`"
HISTSIZE=64000 ; export HISTSIZE
######################
BUT,
I see my root .sh_history file get trimmed by itself? It goes back to around just 120-180 commands. dont know why and dont see cron job doing it.
For troubleshooting, I have a cron script which ll .sh_history every 5 minuts with date and wc -l of .sh_history . No fixed time happening. Why ?
See Below the log file.
1) Jul 19 (14:30) size was 4288 . 5 minutes later, it was 1546
2)Aug 31 (11:55) the size was 9478 and 5 minutes later the size was
1474.
=======================================
Tue Jul 19 14:30:00 EDT 2005
302
-rw------- 1 root sys 4288 Jul 19 12:08 /root/.sh_history
=======================================
Tue Jul 19 14:35:00 EDT 2005
130
-rw------- 1 root sys 1546 Jul 19 14:31 /root/.sh_history
=======================================
========================================
Wed Aug 31 11:55:00 EDT 2005
662
-rw------- 1 root sys 9478 Aug 31 09:19 /root/.sh_history
=======================================
Wed Aug 31 12:00:00 EDT 2005
132
-rw------- 1 root sys 1474 Aug 31 11:57 /root/.sh_history
=======================================
Any Ideas ? If not , I need to modify script so
I compare CUR_SIZE of .sh_history to PREV_SIZE file of when the cron was run 5 minutes ago. If CUR_SIZE is Smaller than PREV_SIZE, send me a page. I have the gist of it down below but have trouble comparing and storing PREV_SIZE variable.
Need to modify
#!/bin/ksh
CUR_SIZE=`ll .sh_history | awk '{print $5}'`
if [ $CUR_SIZE -lt $PREV_SIZE ];then
mailx -s "SIZE CHANGED" pager@abc.com
fi
So, when I get page, i can get on the system and look at cron and other logs.
Thanks
Solved! Go to Solution.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО09-15-2005 05:12 AM
тАО09-15-2005 05:12 AM
Re: .sh_history getting trimmed by itself ? Why ?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО09-15-2005 05:13 AM
тАО09-15-2005 05:13 AM
Re: .sh_history getting trimmed by itself ? Why ?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО09-15-2005 05:17 AM
тАО09-15-2005 05:17 AM
Re: .sh_history getting trimmed by itself ? Why ?
this could be a reason.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО09-15-2005 05:21 AM
тАО09-15-2005 05:21 AM
Re: .sh_history getting trimmed by itself ? Why ?
But if it is changing later, maybe you have a cron job that does some sort of cleanup process and shrinking the .history file is one of its tasks.
HTH
-- Rod Hills
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО09-15-2005 05:27 AM
тАО09-15-2005 05:27 AM
Re: .sh_history getting trimmed by itself ? Why ?
Thanks
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО09-15-2005 05:35 AM
тАО09-15-2005 05:35 AM
Re: .sh_history getting trimmed by itself ? Why ?
#!/bin/ksh
. /tmp/PREVSIZE
CUR_SIZE=`ll .sh_history | awk '{print $5}'`
if [ $CUR_SIZE -lt $PREV_SIZE ];then
mailx -s "SIZE CHANGED" pager@abc.com
fi
echo "export PREV_SIZE=$CUR_SIZE" >/tmp/PREVSIZE
This will retain the PREV_SIZE in a temp file for later fetching.
HTH
-- Rod Hills
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО09-15-2005 05:40 AM
тАО09-15-2005 05:40 AM
Re: .sh_history getting trimmed by itself ? Why ?
While you are fighting with this stange situation (no its nothing to do with too big I just checked:$ wc -l .sh_history
16361 .sh_history)
I would add a cron that makes copie regularly (very) size wont help in undestanding what is going on the countent maybe... Are you sure you have clowns out there that can do a su root of some sort and that would like to remove evidences...?
All the best
Victor
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО09-15-2005 05:46 AM
тАО09-15-2005 05:46 AM
Re: .sh_history getting trimmed by itself ? Why ?
ROOT:S41:/ ==> ll .sh*
-rw------- 1 root sys 83362 Sep 15 12:29 .sh_history
and see same HIST variables.
# HISTFILE=$HOME.sh_history
HISTFILE=/.sh_history
HISTSIZE=64000
print -s "LOGIN - `date '+%m-%d-%E-%H:%M'`"
export HISTFILE HISTSIZE #
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО09-15-2005 05:53 AM
тАО09-15-2005 05:53 AM
SolutionI've had problems with that myself....
Sometimes it blanks it out....don't know why....
If you have multiple admins, do this to setup multiple sh_histories:
# Set up logging
HISTFILE=${HOME}/.sh_history_`who am i|awk '{ print $1}'`
export HISTFILE
print -s "### login at `/usr/bin/date` ###"
HISTSIZE=50000
export HISTSIZE
Rgds...Geoff
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО09-15-2005 06:12 AM
тАО09-15-2005 06:12 AM
Re: .sh_history getting trimmed by itself ? Why ?
That may make sense but this thing is so darn random.
If print -s blanks it out, then I will not use and see if that makes a difference. How would I othewise insert date in the .sh_history file. just echo `date` >> /root/.sh_history thru cron will do it but is that advisable. I dont want to maintain separate history files as it is easier to peruse one file as we command recall each other commands.
Thanks a bunch though. i will post to see if what you suggested works.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО09-15-2005 06:15 AM
тАО09-15-2005 06:15 AM
Re: .sh_history getting trimmed by itself ? Why ?
you may be onto something (though not sure) because I saw another hp system which had huge history file but print command was commented out.
Thanks
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО09-15-2005 06:40 AM
тАО09-15-2005 06:40 AM
Re: .sh_history getting trimmed by itself ? Why ?
# cat /usr/local/bin/datestamp-root-history
#!/bin/sh
#
# script to add a date stamp to the /.sh_history_$USER
# for those su'ed to root
# Only run from cron once a day
# gwild 2004-10-15 with help from jkittle
#===================================================================
# initialize some variables
#===================================================================
ULOG=/tmp/datestamp-user.log
cat /dev/null > $ULOG
#===========================================================
# Function: TimeStamp
# Description: timestamp the /.sh_history_$USER
# Arguments: none
# Returns: none
#===========================================================
function TimeStamp {
# point to their .sh_history file
# time stamp it
echo "HISTFILE is $HISTFILE"
(export HISTFILE=${HOME}/.sh_history_$UNIQUSER; echo "HISTFILE is $HISTFILE"; print -s "### `/usr/bin/date` $UNIQUSER still logged in as root...###")
unset HISTFILE
echo "HISTFILE after unset is $HISTFILE"
}
#===================================================================
# BEGIN MAIN CODE
#===================================================================
# find parent process of all users signed in as root
for i in `ps -ef |grep "\-sh"|awk '{print $3}'`
do
# just grab the user name
for USER in `ps -ef |grep $i |grep -v root|awk '{print $1}'`
do
echo $USER >> $ULOG
done
done
# get each user only once
for UNIQUSER in `cat $ULOG |sort|uniq`
do
TimeStamp
done
exit 0
I'm pretty sure it is in the .profile that causes the issue - something to do with not being completely logged in or something - not too sure....
Unfortunately, when you just do say:
date >>$HISTFILE
when you esc k - it proceeds the first command in your history file...ie - doesn't set a proper end of line????
Rgds...Geoff
Rgds...Geoff
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО09-15-2005 08:09 AM
тАО09-15-2005 08:09 AM
Re: .sh_history getting trimmed by itself ? Why ?
I understand, using "print" command is problematic from within .profile but I see you use "print -s" commnd in your TimeStamp function. would that not chop off the history file again.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО09-15-2005 08:27 AM
тАО09-15-2005 08:27 AM
Re: .sh_history getting trimmed by itself ? Why ?
Rgds...Geoff