向linux添加审计日志的功能

在/etc/profile添加如下变量

HISTSIZE=1000
HISTTIMEFORMAT="%Y/%m/%d %T   "
export HISTTIMEFORMAT
export HISTORY_FILE=/etc/audit.log
export PROMPT_COMMAND='{ thisHistID=`history 1|awk "{print \\$1}"`;lastCommand=`history 1| awk "{\\$1=\"\" ;print}"`;user=`id -un`;whoStr=(`who`);realUser=${whoStr[0]};logMonth=${whoStr[2]};logDay=${whoStr[3]};logTime=${whoStr[4]};pid=${whoStr[6]};ip=${whoStr[7]};if [ ${thisHistID}x != ${lastHistID}x ];then echo -E `date "+%Y/%m/%d %H:%M:%S"` $user"("$realUser")"@$ip[PID:$pid][LOGIN:$logMonth $logDay $logTime] --- $lastCommand ;lastHistID=$thisHistID;fi; } >> $HISTORY_FILE' 

实时生效：
source /etc/profile
然后在/etc/audit.log就可以查看所有用户的历史操作