Linux开启服务器操作日志

来源：服务器多人操作的时候，难免会产生一些不愉快的操作，这时候可以开启服务器日志，查看用户具体干了什么操作

1.编辑 /etc/profile 文件 在结尾追加一下内容

mkdir -m 777 -p /.cmdlog 2>&-
declare -r HISTTIMEFORMAT='%F %T ### '
declare -r HISTCONTROL=''
RSSHTTY=$(who am i |awk '{print $2}')
if [ "$SSH_CONNECTION" ];then 
RSSH_CLIENTIP=$(echo $SSH_CONNECTION |awk '{ print $1}') 
RSSH_HOSTIP=$(echo $SSH_CONNECTION |awk '{ print $3}') 
else 
RSSH_CLIENTIP=$(who am i|awk '{print $5}' |sed 's/[()]//g') 
RSSH_HOSTIP=$(ip addr | grep inet| grep -v 127 | grep -v inet6 |grep -v virbr| head -n 1 | awk -F/ '{print $1}' |  awk '{print $2}')
fi
RCMDLOG_FILE="/.cmdlog/cmdlog.$(date +%F)"
[ -f $RCMDLOG_FILE -a -s $RCMDLOG_FILE ] || install -m 777 /dev/null $RCMDLOG_FILE 2>&-
RLOGIN_TIMESTAMP=`date +%s`

rsprompt_command() {
RHISTCMD_PREV=$(history 1);RACTIONDATE=$(history 1|awk '{print $2" "$3}');RACTIONTIME=$(date -d "$RACTIONDATE" +%s)
if [ "$RHISTCMD_BEFORE_LAST" != "$RHISTCMD_PREV" ] && [ "$RACTIONTIME" -ge "$RLOGIN_TIMESTAMP" ]; then 
{ date "+%F %T ### ${HOSTNAME} ### ${USER} ### ${RSSHTTY} ### ${RSSH_CLIENTIP} ### ${RSSH_HOSTIP} ### ${SSH_CONNECTION} ### ${PWD} ### $RLOGIN_TIMESTAMP ###$(history 1|awk "{\$1=\"\";print}")"; } 2>&- >> $RCMDLOG_FILE
fi
RHISTCMD_BEFORE_LAST=$RHISTCMD_PREV
}
declare -r PROMPT_COMMAND='rsprompt_command'

2.source /etc/profile 刷新文件

3.在根目录 .cmdlog下回会生成日志操作记录

4.tail -f /.cmdlog/cmdlog.2023-02-22 查看日志