转载与曹阳:
修改如下/etc/下的如下文件,或者用户目录下的对应/root/.bash_profile等文件
bash.bashrc:export PROMPT_COMMAND='msg=$(history 1 | { read x y; echo "$y"; });user=$(whoami);loginuser=$(who am i); logger -t user_cmd "${msg} by ${user} from [$loginuser]"'
csh.cshrc.local:alias precmd 'set msg = `history 1|cut -f3-|sed -e "s|{||g" | sed -e "s|}||g"` ; set user = `whoami` ; set loginuser = `who am i`; logger -t user_cmd "${msg} by ${user} from [$loginuser]" >/dev/null'
ksh.kshrc:export PROMPT_COMMAND='msg=$(history 1 | { read x y; echo "$y"; });user=$(whoami);loginuser=$(who am i); logger -t user_cmd "${msg} by ${user} from [$loginuser]"'
生效后,效果如下:
ep 2 11:16:08 T3200-51 user_cmd: 2014-09-02 11:15:51 vi /etc/sudoers by root from [root pts/2 2014-08-29 09:06 (10.135.29.97)]
Sep 2 11:16:11 T3200-51 user_cmd: 2014-09-02 11:16:11 cd /etc by root from [root pts/2 2014-08-29 09:06 (10.135.29.97)]
Sep 2 11:16:19 T3200-51 user_cmd: 2014-09-02 11:16:16 grep "user_cmd" * -r by root from [root pts/2 2014-08-29 09:06 (10.135.29.97)]