您的位置:首页 > 运维架构 > Linux

linux纪录系统用户执行过的命令

2013-08-22 16:16 337 查看
在/etc/profile文件里添加:

export HISTSIZE=50000
export HISTORY_FILE=/var/log/CommandHistory.log
export PROMPT_COMMAND='{ thisHistID=`history 1|awk "{print \\$1}"`;lastCommand=`history 1| awk "{\\$1=\"\" ;print}"`;user=`id -un`;whoStr=(`who -u am i`);realUser=${whoStr[0]};logMonth=${whoStr[2]};logDay=${whoStr[3]};pid=${whoStr[5]};ip=${whoStr[6]};if [ ${thisHistID}x != ${lastHistID}x ];then echo -E `date "+%Y/%m/%d %H:%M:%S"` $user\($realUser\)@$ip[Pid:$pid][LoginTime:$logMonth $logDay] ExecuteCommand: $lastCommand;fi; } >> $HISTORY_FILE'


设置普通用户写日志权限:

# chmod 777 /var/log/CommandHistory.log

定期清理脚本:

#!/bin/bash
dt=`date +"%Y%m%d%H%M"`
find /var/log/ -name "CommandHistory*.log" -mtime +15 -exec rm -f {} \;
cat /var/log/CommandHistory.log >/var/log/CommandHistory$dt.log
>/var/log/CommandHistory.log


crontab设置每天执行一次,清理15天前的命令记录,备份前一天的命令记录

参考:

http://www.it165.net/os/html/201308/6011.html
内容来自用户分享和网络整理,不保证内容的准确性,如有侵权内容,可联系管理员处理 点击这里给我发消息
标签: