修改Bash源码进行bash命令执行监控

从bash4.1 版本开始，bash开始支持Rsyslog，所以我们需要下载bash4.1以后版本，这里以bash4.4为例

bash源码下载地址：  https://ftp.gnu.org/gnu/bash/

共计需要修改两处源码：

1.先修改bashhist.c

该源码文件和linux history记录处理相关

#if defined (SYSLOG_HISTORY)
#define SYSLOG_MAXLEN 600

extern char *shell_name;

#ifndef OPENLOG_OPTS
#define OPENLOG_OPTS 0
#endif

void
bash_syslog_history (line)
     const char *line;
{
  char trunc[SYSLOG_MAXLEN];
  static int first = 1;

  if (first)
    {
      openlog (shell_name, OPENLOG_OPTS, SYSLOG_FACILITY);
      first = 0;
    }

  if (strlen(line) < SYSLOG_MAXLEN)
    syslog (SYSLOG_FACILITY|SYSLOG_LEVEL, "HISTORY: PID=%d UID=%d User=%s CMD=%s", getpid(), current_user.uid, current_user.user_name, line);
  else
    {
      strncpy (trunc, line, SYSLOG_MAXLEN);
      trunc[SYSLOG_MAXLEN - 1] = '\0';
      syslog