linux开启user_cmd功能记录用户所有操作指令到log message

修改如下/etc/下的如下文件，或者用户目录下的对应/root/.bash_profile等文件

bash.bashrc:export PROMPT_COMMAND='msg=$(history 1 | { read x y; echo "$y"; });user=$(whoami);loginuser=$(who am i); logger -t user_cmd "${msg} by ${user} from [$loginuser]"'
csh.cshrc.local:alias precmd 'set msg = `history 1|cut -f3-|sed -e "s|{||g" | sed -e "s|}||g"` ; set user = `whoami` ; set loginuser = `who am i`; logger -t user_cmd "${msg} by ${user} from [$loginuser]" >/dev/null'
ksh.kshrc:export PROMPT_COMMAND='msg=$(history 1 | { read x y; echo "$y"; });user=$(whoami);loginuser=$(who am i); logger -t user_cmd "${msg} by ${user} from [$loginuser]"'

 

生效后，效果如下：

ep  2 11:16:08 T3200-51 user_cmd: 2014-09-02 11:15:51 vi /etc/sudoers by root from [root     pts/2        2014-08-29 09:06 (10.135.29.97)]
Sep  2 11:16:11 T3200-51 user_cmd: 2014-09-02 11:16:11 cd /etc by root from [root     pts/2        2014-08-29 09:06 (10.135.29.97)]
Sep  2 11:16:19 T3200-51 user_cmd: 2014-09-02 11:16:16 grep "user_cmd" * -r by root from [root     pts/2        2014-08-29 09:06 (10.135.29.97)]