Login or Register to Ask a Question and Join Our Community


Shell Programming and Scripting

Log all the commands input by user at real time in /var/log/messages

Login to Discuss or Reply to this Discussion in Our Community

 
Thread Tools Search this Thread
Top Forums Shell Programming and Scripting Log all the commands input by user at real time in /var/log/messages
# 8  
Old 01-18-2017
Please don't bump posts.

What user are you attempting to audit? If it's root, one cheap way to do audit is to not give them direct root access and let them do everything through sudo. Every time they call sudo that will be logged.
# 9  
Old 01-18-2017
example we have an activity. i just want to do a tail -f /var/log/messages and i can see what is going on.. I have able to achieve it but not 100%.. Tried a lot of ways but to no avail its not that i am expeting of.

Code:
function log2syslog
{
    logger -p local1.notice -t bash -i -- "$(logname): $BASH_COMMAND"
}

trap log2syslog DEBUG

# 10  
Old 01-18-2017
"example we have an activity" isn't really helpful...

Any and all in-shell ways to do this can be trivially circumvented.

Doing this properly may mean changing the way you do things, not just slapping code onto your existing system.
Last edited by Corona688; 01-18-2017 at 03:07 PM..
# 11  
Old 01-18-2017
I just want to have the output like below.
Code:
Jan 13 17:09:05 SERVER1 bash[727]: user1: vi /etc/httpd/conf.d/httpd.conf
Jan 13 17:09:05 SERVER1 bash[731]: user1:  service httpd restart
Jan 13 17:09:05 SERVER1 bash[735]: user5: tail -f /var/log/messages
Jan 13 17:09:05 SERVER1 bash[739]: user2: sudo su -

# 12  
Old 01-18-2017
Well, RHEL6 supports auditing, I wasn't sure it did. Look here:

Chapter 7. System Auditing
# 13  
Old 01-18-2017
NOted. Thank you. will try to review it.
Thanks
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. Shell Programming and Scripting

Transfer the logs being thrown into /var/log/messages into another file example /var/log/volumelog

I have been searching and reading about syslog. I would like to know how to Transfer the logs being thrown into /var/log/messages into another file example /var/log/volumelog. tail -f /var/log/messages dblogger: msg_to_dbrow: no logtype using missing dblogger: msg_to_dbrow_str: val ==... (2 Replies)
Discussion started by: kenshinhimura
2 Replies

2. SuSE

Non root user want to see /var/log/messages - any suse equivalent of Solaris dmesg

Hi New to Suse - mainly used Solaris. In solaris dmesg will also show you contents of messages log file but in Suse Liux it doesnt appear to. I dont have root access to this Suse server, and wondering is there any other tool / utility that allows me to see the messages file contents like on... (1 Reply)
Discussion started by: frustrated1
1 Replies

3. Shell Programming and Scripting

[solved] How to see log in real time?

Hi people I have a bash script with a line like this: python example.py >> log & But i can't see anything in the log file while python program is running only if the program ends seems to write the log file. "$ cat log" for example don't show anything until the program ends. Is there... (4 Replies)
Discussion started by: Tieso
4 Replies

4. UNIX for Dummies Questions & Answers

/etc/sudoers for allowing oracle user to /var/log/messages

So I want the DBA to access /var/log/messages and so I logged in as root and then edited the sudoers file as follows "oracle ALL= (root) /bin/view, /var/log/messages" However when I login as oracle and try "sudo more /var/log/messages" I get Sorry, user oracle is not allowed to... (1 Reply)
Discussion started by: gubbu
1 Replies

5. Shell Programming and Scripting

How can view log messages between two time frame from /var/log/message or any type of log files

How can view log messages between two time frame from /var/log/message or any type of log files. when logfiles are very big and especially many messages with in few minutes, I would like to display log messages between 5 minute interval. Could you pls give me the command? (1 Reply)
Discussion started by: johnveslin
1 Replies

6. Solaris

Difference between /var/log/syslog and /var/adm/messages

Hi, Is the contents in /var/log/syslog and /var/adm/messages are same?? Regards (3 Replies)
Discussion started by: vks47
3 Replies

7. Solaris

diff b/w /var/log/syslog and /var/adm/messages

hi sirs can u tell the difference between /var/log/syslogs and /var/adm/messages in my working place i am having two servers. in one servers messages file is empty and syslog file is going on increasing.. and in another servers message file is going on increasing but syslog file is... (2 Replies)
Discussion started by: tv.praveenkumar
2 Replies

8. UNIX for Dummies Questions & Answers

help interpreting var/log/messages log

I'm using RHEL and my var/log/messages file is filled with "FTP session opened/closed" lines that happen all day: Aug 2 04:04:38 web proftpd: 74.125.56.10 (142.231.76.249) - FTP session closed. Aug 2 04:05:11 web proftpd: 74.125.56.10 (142.231.88.123) - FTP session opened.Is this normal? We... (2 Replies)
Discussion started by: gaspol
2 Replies

9. Shell Programming and Scripting

Real time log file redirect

Hi all, i would like to write the shell script program, it can monitor the access_log "real time" when the access_log writing the line contain "abcdef" the program will be "COPY" this line into a file named "abcdef.txt", do the same thing if the contain "123456" "COPY" it into a file named... (3 Replies)
Discussion started by: eric_wong_ch
3 Replies

10. UNIX for Dummies Questions & Answers

log users real time

hi.... how i can configurator a log file on real time....on unix solaris.... thanks a lot.... Best Regards... (3 Replies)
Discussion started by: chanfle
3 Replies
Login or Register to Ask a Question