Shell History File

[Scott Hebl]

I would like to add a time stamp to the commands in the history file (.sh_history) for each user.

Anybody have any recommendations for how to accomplish this? Thanks in advanced.

[Patrick Wallek]

I think if you try to add a time stamp to the .sh_history file for each command executed that you will make the file useless for its original purpose.

The .sh_history file is not an auditing tool. Its purpose in life is to provide you with a mechanism to go back and easily redo commands so that you don't have to always type a long command line from scratch everytime. If you added a date/time stamp to the command line you would have something like:

find /dirname -name filename -exec ll -d {} \; 05/16/2001 15:21:35

So that you would then have to go in and delete the date and time before you can use the command rather than just being able to get to it and use it.

I know this isn't much help, just my 2 cents worth.

[James R. Ferguson]

Hi Scott:

While you can't timestamp each command, you could segregate and capture each user's session history. See this thread for some ideas:

http://forums.itrc.hp.com/cm/QuestionAnswer/1,1150,0xa3c66af52b04d5118fef0090279cd0f9,00.html

...JRF...

[A. Clay Stephenson · Accepted solution]

Hi Scott,

Patrick pretty much covered point no. 1 but your question did make me think is there a way that would sort of work. Here's my stab at it (and it's not perfect because it will badly timestamp the existing history file entries).

#!/usr/bin/sh

INFILE=~/.sh_history
OUTFILE=~/.sh_history+
rm -f $OUTFILE
# we have to remove the existing entries or
# they will be timestamped twice
tail -f ${INFILE} | while read X
do
echo "${X} Time: \c" >> ${OUTFILE}
date >> ${OUTFILE}
done

Now if you add a line like this to your .profile; it almosts works
timestamp.sh &

The idea is that although execution time of the first entries are not correct; timestamps of subsequent commands are. Since it's not writing to the .sh_history file, command substitution is not clobbered. Again, not perfect
but what you want would require a shell replacement. To do this right, you have 2 options:
1) Get a freely available shell (bash); modify the source; and deploy it for non-root users.
2) Enable system accounting. This is the tool intended for what you are trying to do - but almost nobody uses because of the overhead.

My 5 cents worth, Clay

[Scott Hebl]

THanks for the help everyone. I will give Clay's idea a shot.