在/etc/profile文件下添加如下shell即可(注意文件的权限问题!!)
if ! test -z "$BASH_EXECUTION_STRING" ; then
echo "===== $(date "+%F %T") $USER nologin cmd: $BASH_EXECUTION_STRING" >>/var/log/command.log
elif shopt -q login_shell ; then
printf "====== $(date "+%F %T") new login the last cmd: ">>/var/log/command.log
else
printf "====== $(date "+%F %T") su the last cmd: ">>/var/log/command.log
fi
export HISTTIMEFORMAT="%F %T $USER ${SSH_TTY:5} ${SSH_CLIENT%% *} "
export PROMPT_COMMAND="history 1|tail -1|sed 's/^[ ]\+[0-9]\+ //'>> /var/log/command.log"
所有命令会被记录在/var/log/command.log可以查看。