.sh_history getting trimmed by itself ? Why ?

[Sammy_2]

HPUX 11.11


root .profile has value set very high (see below)
=====================================

HISTFILE=/root/.sh_history ; export HISTFILE
print -s "LOGIN - `date '+%m-%d-%E-%H:%M'`"
HISTSIZE=64000 ; export HISTSIZE
######################
BUT,
I see my root .sh_history file get trimmed by itself? It goes back to around just 120-180 commands. dont know why and dont see cron job doing it.

For troubleshooting, I have a cron script which ll .sh_history every 5 minuts with date and wc -l of .sh_history . No fixed time happening. Why ?


See Below the log file.
1) Jul 19 (14:30) size was 4288 . 5 minutes later, it was 1546
2)Aug 31 (11:55) the size was 9478 and 5 minutes later the size was
1474.

=======================================
Tue Jul 19 14:30:00 EDT 2005
302
-rw------- 1 root sys 4288 Jul 19 12:08 /root/.sh_history
=======================================
Tue Jul 19 14:35:00 EDT 2005
130
-rw------- 1 root sys 1546 Jul 19 14:31 /root/.sh_history
=======================================


========================================
Wed Aug 31 11:55:00 EDT 2005
662
-rw------- 1 root sys 9478 Aug 31 09:19 /root/.sh_history
=======================================
Wed Aug 31 12:00:00 EDT 2005
132
-rw------- 1 root sys 1474 Aug 31 11:57 /root/.sh_history
=======================================
Any Ideas ? If not , I need to modify script so
I compare CUR_SIZE of .sh_history to PREV_SIZE file of when the cron was run 5 minutes ago. If CUR_SIZE is Smaller than PREV_SIZE, send me a page. I have the gist of it down below but have trouble comparing and storing PREV_SIZE variable.


Need to modify
#!/bin/ksh
CUR_SIZE=`ll .sh_history | awk '{print $5}'`
if [ $CUR_SIZE -lt $PREV_SIZE ];then
mailx -s "SIZE CHANGED" pager@abc.com
fi


So, when I get page, i can get on the system and look at cron and other logs.

Thanks

[Alan Meyer_4]

The HISTSIZE variable is set by default to 128 and limits the number of commands in the HISTFILE to that. You can set the HISTFILE parameter in your profile to retain more if needed.

[Alan Meyer_4]

oops, nevermind... you already new that... sorry

[Florian Heigl (new acc)]

is the root account shared?

this could be a reason.

[Rodney Hills]

I wonder if 64000 is too big. Maybe the number is converted to a 32 bit integer, which 64000 would be 0xFA00 (a negative number) and the system defaults to 128?

But if it is changing later, maybe you have a cron job that does some sort of cleanup process and shrinking the .history file is one of its tasks.

HTH

-- Rod Hills

[Sammy_2]

No, root is not shared. And just for grins, I have change HISTSIZE=2000. Anyway, how could I modify the script to do CUR_SIZE /PREV_SIZE comparison ?
Thanks

[Rodney Hills]

Make the following change-

#!/bin/ksh
. /tmp/PREVSIZE
CUR_SIZE=`ll .sh_history | awk '{print $5}'`
if [ $CUR_SIZE -lt $PREV_SIZE ];then
mailx -s "SIZE CHANGED" pager@abc.com
fi
echo "export PREV_SIZE=$CUR_SIZE" >/tmp/PREVSIZE

This will retain the PREV_SIZE in a temp file for later fetching.

HTH

-- Rod Hills

[Victor BERRIDGE]

Hi Sammy,
While you are fighting with this stange situation (no its nothing to do with too big I just checked:$ wc -l .sh_history
16361 .sh_history)
I would add a cron that makes copie regularly (very) size wont help in undestanding what is going on the countent maybe... Are you sure you have clowns out there that can do a su root of some sort and that would like to remove evidences...?


All the best
Victor

[Sammy_2]

I think I locked out those clowns after SOX made us restrict access to just true Sys admins. Actually, i am seeing similiar behavior on some other hp servers as well but other like one below this has a huge history file.Thats what i want.


ROOT:S41:/ ==> ll .sh*
-rw------- 1 root sys 83362 Sep 15 12:29 .sh_history

and see same HIST variables.
# HISTFILE=$HOME.sh_history
HISTFILE=/.sh_history
HISTSIZE=64000
print -s "LOGIN - `date '+%m-%d-%E-%H:%M'`"
export HISTFILE HISTSIZE #

[Geoff Wild · Accepted solution]

It's the print -s

I've had problems with that myself....

Sometimes it blanks it out....don't know why....

If you have multiple admins, do this to setup multiple sh_histories:

# Set up logging
HISTFILE=${HOME}/.sh_history_`who am i|awk '{ print $1}'`
export HISTFILE
print -s "### login at `/usr/bin/date` ###"
HISTSIZE=50000
export HISTSIZE


Rgds...Geoff

[Sammy_2]

Geoff,
That may make sense but this thing is so darn random.
If print -s blanks it out, then I will not use and see if that makes a difference. How would I othewise insert date in the .sh_history file. just echo `date` >> /root/.sh_history thru cron will do it but is that advisable. I dont want to maintain separate history files as it is easier to peruse one file as we command recall each other commands.

Thanks a bunch though. i will post to see if what you suggested works.

[Sammy_2]

Geoff,
you may be onto something (though not sure) because I saw another hp system which had huge history file but print command was commented out.

Thanks

[Geoff Wild]

Yes - I have also done it like this from cron:

# cat /usr/local/bin/datestamp-root-history
#!/bin/sh
#
# script to add a date stamp to the /.sh_history_$USER
# for those su'ed to root
# Only run from cron once a day
# gwild 2004-10-15 with help from jkittle

#===================================================================
# initialize some variables
#===================================================================
ULOG=/tmp/datestamp-user.log
cat /dev/null > $ULOG


#===========================================================
# Function: TimeStamp
# Description: timestamp the /.sh_history_$USER
# Arguments: none
# Returns: none
#===========================================================
function TimeStamp {
# point to their .sh_history file
# time stamp it
echo "HISTFILE is $HISTFILE"
(export HISTFILE=${HOME}/.sh_history_$UNIQUSER; echo "HISTFILE is $HISTFILE"; print -s "### `/usr/bin/date` $UNIQUSER still logged in as root...###")
unset HISTFILE
echo "HISTFILE after unset is $HISTFILE"
}



#===================================================================
# BEGIN MAIN CODE
#===================================================================

# find parent process of all users signed in as root
for i in `ps -ef |grep "\-sh"|awk '{print $3}'`
do
# just grab the user name
for USER in `ps -ef |grep $i |grep -v root|awk '{print $1}'`
do
echo $USER >> $ULOG
done
done

# get each user only once
for UNIQUSER in `cat $ULOG |sort|uniq`
do
TimeStamp
done

exit 0


I'm pretty sure it is in the .profile that causes the issue - something to do with not being completely logged in or something - not too sure....

Unfortunately, when you just do say:

date >>$HISTFILE

when you esc k - it proceeds the first command in your history file...ie - doesn't set a proper end of line????

Rgds...Geoff



Rgds...Geoff

[Sammy_2]

Good One Geoff !!! will make use of the script.
I understand, using "print" command is problematic from within .profile but I see you use "print -s" commnd in your TimeStamp function. would that not chop off the history file again.

[Geoff Wild]

So far I havn't had trouble with the cron job - doesn't mean it is guaranteed though!

Rgds...Geoff