Wednesday, August 20, 2014

How to log all unix shell commands submitted by all users

Use your favourite text editor to open /etc/bashrc and append the following line at the end:
export PROMPT_COMMAND='RETRN_VAL=$?;logger \

-p local6.debug "$(whoami) [$$]: $(history 1 | \
sed "s/^[ ]*[0-9]\+[ ]*//" ) [$RETRN_VAL]"'
Set the syslogger to trap local6 to a log file by adding this line in the /etc/syslog.conf file:
[for ubuntu it is /etc/rsyslog.conf]
local6.* /var/log/cmdlog.log
root@ubuntu:/var/log# tail -f cmdlog.log
Apr 11 20:39:00 ubuntu root: root [8147]:  [0]
Apr 11 20:39:06 ubuntu root: root [8147]: su – jahmed [1]
Apr 11 20:39:11 ubuntu root: root [8147]: ls [0]
Apr 11 20:39:13 ubuntu root: root [8147]: ls -ltra [0]

No comments:

Post a Comment