linux 用户行为审计

在/etc/profile文件下添加如下shell即可（注意文件的权限问题！！）

if ! test -z  "$BASH_EXECUTION_STRING" ; then
          echo "===== $(date "+%F  %T") $USER nologin cmd:   $BASH_EXECUTION_STRING" >>/var/log/command.log
  elif  shopt -q login_shell ; then
          printf "====== $(date "+%F  %T") new login the last cmd: ">>/var/log/command.log
  else
          printf "====== $(date "+%F  %T") su  the last cmd:  ">>/var/log/command.log
  fi
  export  HISTTIMEFORMAT="%F %T  $USER  ${SSH_TTY:5} ${SSH_CLIENT%% *}  "
  export PROMPT_COMMAND="history  1|tail -1|sed 's/^[ ]\+[0-9]\+   //'>> /var/log/command.log"

所有命令会被记录在/var/log/command.log可以查看。