Skip to content

Commit 5c8ebe6

Browse files
Update README.md
1 parent 4a9e3a6 commit 5c8ebe6

File tree

1 file changed

+10
-4
lines changed

1 file changed

+10
-4
lines changed

README.md

+10-4
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,13 @@ no | field | description
4242

4343
# SET-UP
4444

45-
1. Create a file named "e.g) history_log.sh" under the "/etc/profile.d/" directory and add the following code to it:
45+
1. Add the `HISTTIMEFORMAT` in the /etc/profile
46+
```bash
47+
HISTSIZE=2000
48+
HISTTIMEFORMAT="[%Y-%m-%d %H:%M:%S] "
49+
```
50+
51+
2. Create a file named "e.g) history_log.sh" under the "/etc/profile.d/" directory and add the following code to it:
4652
```bash
4753
logger -p local7.notice -t cmd_h1st "datetime='$(date +"%Y-%m-%d %T")',tty='$(tty | cut -d '/' -f 3-4)',bash_pid='$$',type='new_login',username='$LOGNAME',message='$LOGNAME logged at $(date +"%Y-%m-%d %T") from $(tty | awk -F "/" '{print $3"/"$4}' | xargs -I % bash -c 'w | grep -i %' | awk '{print $3}')'"
4854

@@ -54,7 +60,7 @@ function log_command {
5460
local shell_status=$([[ "$(id -u)" == "0" ]] && echo "#" || echo "$")
5561
local remote_ip=$(tty | awk -F "/" '{print $3"/"$4}' | xargs -I % bash -c 'w | grep -i %' | awk '{print $3}')
5662
local pwd=$(pwd)
57-
local command="$1"
63+
local command=$(echo "$1" | cut -f 4- -d ' ')
5864
local cmd_retn_code="$2"
5965
local cmd_pid="$3"
6066
local sudo_chk=$(echo "$command" | grep -q "sudo" && echo "y" || echo "n")
@@ -69,14 +75,14 @@ PROMPT_COMMAND='__ret="$?"; __cmd=$(history 1 | sed "s/^[ ]*[0-9]\+[ ]*//g"); __
6975

7076
```
7177

72-
2. Open the "/etc/rsyslog.conf" file and add the configuration to save in local6.info format to the "/var/log/command.log" file.
78+
3. Open the "/etc/rsyslog.conf" file and add the configuration to save in local6.info format to the "/var/log/command.log" file.
7379
```
7480
# vim /etc/rsyslog.conf
7581
.....
7682
local7.notice /var/log/command.log
7783
```
7884

79-
3. Restart the rsyslog service to apply the changes.
85+
4. Restart the rsyslog service to apply the changes.
8086
```
8187
# systemctl restart rsyslog.service
8288
```

0 commit comments

Comments
 (0)