Login or Register to Ask a Question and Join Our Community


Shell Programming and Scripting

Log all the commands input by user at real time in /var/log/messages

Login to Discuss or Reply to this Discussion in Our Community

 
Thread Tools Search this Thread
Top Forums Shell Programming and Scripting Log all the commands input by user at real time in /var/log/messages
# 1  
Old 01-17-2017
Log all the commands input by user at real time in /var/log/messages
Below is my script to log all the command input by any user to /var/log/messages. But I cant achieve the desired output that i want. PLease see below.

Code:
function log2syslog
{
   declare COMMAND
   COMMAND=$(fc -ln -0)
   logger -p local1.notice -t bash -i -- "$USER:$COMMAND"
}
trap log2syslog DEBUG

Desired Output:
HTML Code:
Jan 13 17:09:05 SERVER1 bash[727]: user1: ls -l
Jan 13 17:09:05 SERVER1 bash[731]: user1:  hostname
Jan 13 17:09:05 SERVER1 bash[735]: user5: uname -a
Jan 13 17:09:05 SERVER1 bash[739]: user2: clear
# 2  
Old 01-17-2017
WHAT's going wrong? You might want to use logger line by line.
# 3  
Old 01-17-2017
Hi RudiC,
This the output that i have. EMPTY

Code:
Jan 17 14:51:12 SERVER1 bash[143477]: root:#011 
Jan 17 14:51:28 SERVER1 bash[143480]: root:#011 
Jan 17 14:51:28 SERVER1 bash[143483]: root:#011 
Jan 17 14:51:28 SERVER1 bash[143486]: root:#011 
Jan 17 14:51:28 SERVER1 bash[143489]: root:#011

---------- Post updated at 11:36 PM ---------- Previous update was at 11:05 PM ----------

This is the current output that i have..

Code:
Jan 17 15:32:34 SERVER1 bash[146147]: user1 as root:
Jan 17 15:32:34 SERVER1 bash[146151]: user1 as root:
Jan 17 15:32:34 SERVER1 bash[146155]: user1 as root:
Jan 17 15:32:34 SERVER1 bash[146159]: user1 as root:
Jan 17 15:32:34 SERVER1 bash[146163]: user1 as root:
Jan 17 15:32:34 SERVER1 bash[146189]: user1 as root:#011 exit
Jan 17 15:32:37 SERVER1 bash[146193]: user1 as root:#011 exit
Jan 17 15:32:37 SERVER1 bash[146198]: user1 as root:#011 exit
Jan 17 15:32:43 SERVER1 bash[146210]: user1 as root:#011 hostname
Jan 17 15:32:43 SERVER1 bash[146215]: user1 as root:#011 hostname
Jan 17 15:32:49 SERVER1 bash[146422]: user1 as root:#011 uname -a
Jan 17 15:32:49 SERVER1 bash[146426]: user1 as root:#011 uname -a

My New source code

Code:
function log2syslog
{
        declare COMMAND
        declare LOGUSER
        COMMAND=$(fc -ln -0)
        LOGUSER=$(logname)
        logger -p local0.notice -t bash -i -- "${LOGUSER} as ${USER}:${COMMAND}"
}
trap log2syslog DEBUG

Last edited by rbatte1; 01-17-2017 at 11:57 AM.. Reason: Added CODE tags for file EMPTY
# 4  
Old 01-17-2017
How about using builtin audit software from your operating system.

Audit configuration can look scary at first, but it's mostly a one time setup per requirement.

Writing custom scripts will only make things difficult in the future.
Not to mention bypassing such scripts could be trivial, beating the audit purpose completely.

Hope that helps
Regards
Peasant.
# 5  
Old 01-17-2017
So it will throw the output below in /var/log/audit/audit.log? I beleive I have tried this before.
THanks


Code:
Jan 13 17:09:05 SERVER1 bash[727]: user1: ls -l
Jan 13 17:09:05 SERVER1 bash[731]: user1:  hostname
Jan 13 17:09:05 SERVER1 bash[735]: user5: uname -a
Jan 13 17:09:05 SERVER1 bash[739]: user2: clear


Moderator's Comments:
Mod Comment Please use CODE tags as required by forum rules!
Last edited by RudiC; 01-18-2017 at 06:00 AM.. Reason: Added CODE tags.
# 6  
Old 01-17-2017
What's your system?
# 7  
Old 01-18-2017
RHEL6 sir

---------- Post updated 01-19-17 at 01:26 AM ---------- Previous update was 01-18-17 at 03:18 AM ----------

Any feedback sir?
Thanks
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. Shell Programming and Scripting

Transfer the logs being thrown into /var/log/messages into another file example /var/log/volumelog

I have been searching and reading about syslog. I would like to know how to Transfer the logs being thrown into /var/log/messages into another file example /var/log/volumelog. tail -f /var/log/messages dblogger: msg_to_dbrow: no logtype using missing dblogger: msg_to_dbrow_str: val ==... (2 Replies)
Discussion started by: kenshinhimura
2 Replies

2. SuSE

Non root user want to see /var/log/messages - any suse equivalent of Solaris dmesg

Hi New to Suse - mainly used Solaris. In solaris dmesg will also show you contents of messages log file but in Suse Liux it doesnt appear to. I dont have root access to this Suse server, and wondering is there any other tool / utility that allows me to see the messages file contents like on... (1 Reply)
Discussion started by: frustrated1
1 Replies

3. Shell Programming and Scripting

[solved] How to see log in real time?

Hi people I have a bash script with a line like this: python example.py >> log & But i can't see anything in the log file while python program is running only if the program ends seems to write the log file. "$ cat log" for example don't show anything until the program ends. Is there... (4 Replies)
Discussion started by: Tieso
4 Replies

4. UNIX for Dummies Questions & Answers

/etc/sudoers for allowing oracle user to /var/log/messages

So I want the DBA to access /var/log/messages and so I logged in as root and then edited the sudoers file as follows "oracle ALL= (root) /bin/view, /var/log/messages" However when I login as oracle and try "sudo more /var/log/messages" I get Sorry, user oracle is not allowed to... (1 Reply)
Discussion started by: gubbu
1 Replies

5. Shell Programming and Scripting

How can view log messages between two time frame from /var/log/message or any type of log files

How can view log messages between two time frame from /var/log/message or any type of log files. when logfiles are very big and especially many messages with in few minutes, I would like to display log messages between 5 minute interval. Could you pls give me the command? (1 Reply)
Discussion started by: johnveslin
1 Replies

6. Solaris

Difference between /var/log/syslog and /var/adm/messages

Hi, Is the contents in /var/log/syslog and /var/adm/messages are same?? Regards (3 Replies)
Discussion started by: vks47
3 Replies

7. Solaris

diff b/w /var/log/syslog and /var/adm/messages

hi sirs can u tell the difference between /var/log/syslogs and /var/adm/messages in my working place i am having two servers. in one servers messages file is empty and syslog file is going on increasing.. and in another servers message file is going on increasing but syslog file is... (2 Replies)
Discussion started by: tv.praveenkumar
2 Replies

8. UNIX for Dummies Questions & Answers

help interpreting var/log/messages log

I'm using RHEL and my var/log/messages file is filled with "FTP session opened/closed" lines that happen all day: Aug 2 04:04:38 web proftpd: 74.125.56.10 (142.231.76.249) - FTP session closed. Aug 2 04:05:11 web proftpd: 74.125.56.10 (142.231.88.123) - FTP session opened.Is this normal? We... (2 Replies)
Discussion started by: gaspol
2 Replies

9. Shell Programming and Scripting

Real time log file redirect

Hi all, i would like to write the shell script program, it can monitor the access_log "real time" when the access_log writing the line contain "abcdef" the program will be "COPY" this line into a file named "abcdef.txt", do the same thing if the contain "123456" "COPY" it into a file named... (3 Replies)
Discussion started by: eric_wong_ch
3 Replies

10. UNIX for Dummies Questions & Answers

log users real time

hi.... how i can configurator a log file on real time....on unix solaris.... thanks a lot.... Best Regards... (3 Replies)
Discussion started by: chanfle
3 Replies
Login or Register to Ask a Question