命令记录加执行时间
export HISTTIMEFORMAT="%F %T `whoami`"
效果如下:
25 2017-06-06 10:17:07 louisifup enp0s3
26 2017-06-06 10:17:07 louissu - root
27 2017-06-06 10:17:07 louisifconfig
28 2017-06-06 10:17:07 louisping 192.168.1.6
29 2017-06-06 10:17:07 louiscurl 192.168.1.6
30 2017-06-06 10:17:07 louisroute -n
31 2017-06-06 10:17:07 louiscurl -I 192.168.1.6
32 2017-06-06 10:17:07 louisps -ef | grep salt
33 2017-06-06 10:17:07 louissu - root
34 2017-06-06 10:17:07 louisls
35 2017-06-06 10:17:07 louishistory
36 2017-06-06 10:17:07 louisvi /var/log/messages
37 2017-06-06 10:17:07 louissu - root
38 2017-06-06 10:17:09 louislls
39 2017-06-06 10:17:09 louisllls
40 2017-06-06 10:17:11 louis,sk
41 2017-06-06 10:17:16 louishistory
讲登陆系统的人指定的命令以及时间,执行命令所在的目录记录到系统日志。
export PROMPT_COMMAND='{ msg=$(history 1 | { read x y; echo $y; }); logger "[euid=$(whoami)]":$(who am i):[`pwd`]"$msg";}'
/var/log/message 内容变为:
Jun 6 10:17:11 centser2 louis: [euid=louis]:louis pts/0 2017-06-06 10:17 (192.168.1.4):[/home/louis]2017-06-06 10:17:11 louis,sk
Jun 6 10:17:11 centser2 louis: [euid=louis]:louis pts/0 2017-06-06 10:17 (192.168.1.4):[/home/louis]2017-06-06 10:17:11 louis,sk
Jun 6 10:17:16 centser2 louis: [euid=louis]:louis pts/0 2017-06-06 10:17 (192.168.1.4):[/home/louis]2017-06-06 10:17:16 louishistory
Jun 6 10:23:34 centser2 louis: [euid=louis]:louis pts/0 2017-06-06 10:17 (192.168.1.4):[/home/louis]2017-06-06 10:17:16 louishistory
Jun 6 10:23:35 centser2 louis: [euid=louis]:louis pts/0 2017-06-06 10:17 (192.168.1.4):[/home/louis]2017-06-06 10:23:35 louisls
Jun 6 10:23:35 centser2 louis: [euid=louis]:louis pts/0 2017-06-06 10:17 (192.168.1.4):[/home/louis]2017-06-06 10:23:35 louisls
Jun 6 10:23:35 centser2 louis: [euid=louis]:louis pts/0 2017-06-06 10:17 (192.168.1.4):[/home/louis]2017-06-06 10:23:35 louisls
Jun 6 10:23:36 centser2 louis: [euid=louis]:louis pts/0 2017-06-06 10:17 (192.168.1.4):[/home/louis]2017-06-06 10:23:35 louisls
Jun 6 10:23:39 centser2 su: (to root) louis on pts/0
Jun 6 10:23:39 centser2 louis: [euid=root]:louis pts/0 2017-06-06 10:17 (192.168.1.4):[/root]2017-06-06 10:23:39 roothistory