6

we are 100% Linux user across the network and we do work round clock, what happens shift change next admin come to his shift on that time what all issues comes he get resolve the issues but they just clear history from terminal. If we want record every at terminal what they have done to resolve the same issues or we can monitor as well, for trouble ticket we have internal OTRS which they update for reporting.

Thanks ton

4 Answers 4

3

When I want to log a root session I use rootsh. If admins are required to use sudo for all commands, it will also log all commands.

You might take a look at screen too, as it might accomplish what you're attempting to do.

Ultimately, logging may not be the best situation for your workflow. Requiring a motd, wiki, or simple Web site to be updated for all changes may be better.

1
  • The rootsh app is now deprecated since the capabilities have been added to sudo. Using sudosh you can automatically log entire SSH sessions and then use the sudoreplay command to review those logs. Use sudosh to as a login shell to force audit logs (github.com/cloudposse/sudosh) Mar 14, 2017 at 0:44
3

Take a look at my history logging functions and see if they could be adapted to your needs.

This is what a couple of typical lines from my log file might look like:

echo hello ### [email protected] Bash-4.0 /dev/pts/1 192.168.2.22 20100510 17:53 /home/user/test
cd .. ### [email protected] Bash-4.0 /dev/pts/1 192.168.2.22 20100510 17:53 /home/user/test -> /home/user

The first line above includes a command, a comment marker, the user/host, shell version, terminal device and IP, the date and time and the directory that was current when the command was issued. The second line is an example of an entry that is produced when a cd command is used and the function's -t option is active. It shows the previous and new working directories.

To set that up:

  • Source the function
  • set the variable
    hcmntextra='date "+%Y%m%d %R"'
  • set the variable
    PROMPT_COMMAND='hcmnt -eityl ~/.hcmnt.log "$LOGNAME@$HOSTNAME Bash-${BASH_VERSION%.*}"'

Choose appropriate locations for files and add the steps above to your ~/.bashrc files.

The function takes several optional switches. One of interest may be -l. With it, commands are written to a log file. You can grep that file and copy and paste commands that you need to re-run. If you omit that switch, the annotated lines are instead written to the shell's history where they can be recalled and reused using the history manipulation features of Bash. The fact that the annotations follow a comment character means that you can re-use the commands as-is and the annotations will be ignored.

2
  • It sounds like they are wanting to monitor people who don't want to be monitored. If neolix uses your solution all the "evil" admins have to do is remove the setting from their environment. Not really much different than clearing the history
    – ScottZ
    May 11, 2010 at 6:31
  • @ScottZ: That's certainly a potential issue, but it's not the way a read the question. May 11, 2010 at 8:00
2

Here's a manual option. Try the script command.

script -a ticketnum.txt then do what you need to do ctrl+d stops the recording and the resulting file can be attached to the ticket. I'm sure this can be automated a bit with some scripting.

1

You may be interested in something like shell_sink for recording and annotating your shell history.

1
  • thanks a ton i'm trying out if don't understood any thing i'll keep bothering thanks ton
    – neolix
    May 10, 2010 at 19:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .