bash 历史命令 送入syslog

 cat bashhist.c |grep pid

    syslog (SYSLOG_FACILITY|SYSLOG_LEVEL, "HISTORY: PPID=%d PID=%d UID=%d %s", getppid(), getpid(), current_user.uid, line);
      syslog (SYSLOG_FACILITY|SYSLOG_LEVEL, "HISTORY (TRUNCATED): PPID=%d PID=%d UID=%d %s", getppid(), getpid(), current_user.uid, trunc);

 

这样可以显示ppid，跟踪sh切换后的用户

 

bash 4.1 增加了syslog 历史命令的功能，编译时 vi config-top.h 將此行/*#define SYSLOG_HISTORY*/ 修改為#define SYSLOG_HISTORY ‧./configure & make ‧ make install 這樣就可以使用bash-4.1 的新功能了，历史命令保存到syslog！

 

 cat bashhist.c |grep pid
    syslog (SYSLOG_FACILITY|SYSLOG_LEVEL, "HISTORY:SID=%d PPID=%d PID=%d UID=%d %s", getsid(getpid()), getppid(), getpid(), current_user.uid, line);
      syslog (SYSLOG_FACILITY|SYSLOG_LEVEL, "HISTORY (TRUNCATED):SID=%d PPID=%d PID=%d UID=%d %s", getsid(getpid()), getppid(), getpid(), current_user.uid, trunc);

 

增加sid 用户切换也可以跟踪，su - mysql等等

 

 

 

 

 sed -e 's/HISTORY: PID=%d UID=%d %s", getpid(),/HISTORY:SID=%d PPID=%d PID=%d UID=%d %s", getsid(getpid()), getppid(), getpid(),/' -e 's/HISTORY (TRUNCATED): PID=%d UID=%d %s", getpid(),/HISTORY (TRUNCATED):SID=%d PPID=%d PID=%d UID=%d %s", getsid(getpid()), getppid(), getpid(),/' bashhist.c>bashhist.c.1;mv bashhist.c bashhist.c.2;mv bashhist.c.1 bashhist.c; diff bashhist.c bashhist.c.2

 

 

 

bash升级、增加syslog功能并统一记录到日志服务器、记录history命令、并可以取出key登录的key-comment用户名和ip，

 

 

 

http://blog.hellosa.org/2013/07/27/log-bash-history-to-syslog-on-centos-6.html

http://www.366yw.com/?p=590

 

评论

3 楼 zdx3578 2014-02-07  

Feb  7 16:29:30 temp sshd[20655]: Accepted password for root from 110.80.101.70 port 53698 ssh2
Feb  7 16:29:30 temp sshd[20655]: pam_unix(sshd:session): session opened for user root by (uid=0)
Feb  7 16:29:48 temp -bash: HISTORY: SID=20657 PPID=20655 PID=20657 UID=0 w
Feb  7 16:31:04 temp -bash: HISTORY: SID=20657 PPID=20655 PID=20657 UID=0 ps -efjH
Feb  7 16:31:20 temp -bash: HISTORY: SID=20657 PPID=20655 PID=20657 UID=0 bash --version
Feb  7 16:31:32 temp -bash: HISTORY: SID=20657 PPID=20655 PID=20657 UID=0 /bin/bash.bak --version
Feb  7 16:32:20 centostmp-lvm nagios: Auto-save of retention data completed successfully.
Feb  7 16:32:33 temp -bash: HISTORY: SID=20657 PPID=20655 PID=20657 UID=0 cat /etc/rsyslog.conf

登录ip关联到sshd进程号，sshd进程号关联到pid sid，切换用户sid可以关联

2 楼 zdx3578 2014-02-07  

if $programname == 'sshd' then @@192.168.0.2:514
if $programname contains 'bash' then @@192.168.0.2:514

1 楼 zdx3578 2014-01-27  

for i in `ls ../bash-4.2-patches` ;do patch -p0  <  ../bash-4.2-patches/$i ; done