Give the history command a date and time and collect the history files of all users with a script
Overview
As a quick way to get the operation log on linux, I added the date and time to the user's ~ / .bash_history.
Setting
If you execute the history command, you can see the history of the commands executed in the past, but since there is no date and time, you do not know when it was executed.
Therefore, add the following sentence to ~ / .profile.
HISTTIMEFORMAT='%y/%m/%d %H:%M:%S ';
If you write it in /etc/profile.d/history.sh, you can set it for each individual account, but this time we want to apply it to the whole, so write it in ~ / .profile.
| setting file | Usage | Example |
|---|---|---|
| ~/.profile | -Describe what applies to the entire session at login | Describe something that does not depend on the type of shell |
| ~/.bashrc | Describe what is only used in bash | alias |
| Shell options | Prompt settings | ~/.bash_profile |
I referred to this article. Linux: Understand the difference between .bashrc and .bash_profile this time
Get script
Since the file name for each user is the same in ~ / .bash_history, prepare a folder for each user and copy it with the following script.
#!/bin/sh
#Let user1 be the working user and delete the previous file in the working folder before copying
sudo find /home/user1/log/ -name ".bash_history" -type f -print | xargs rm -f
#user1,user2,Copy user3 files to user1's log folder
for a in "user1" "usesr2" "user3" ; do
sudo cp -f /home/$a/.bash_history /home/user1/log/$a/;
done
result
You can get a file like this.
Recommended Posts