How to log all Bash commands by all users on a server
Скрытое логгирование действий всех пользователей
Our small company runs an Ubuntu Server 11.10, to which a couple of people have SSH access. The actual terminals are sometimes used, too. How can we locally log all Bash commands run, along with user and time stamp
We can assume that no-one is nefarious and actively trying to avoid the logging, but we’d still prefer the users not to have direct write-access to their log files. Simultaneous sessions must be handled correctly.
For BASH shells, edit the system-wide BASH runtime config file:
Append to the end of that file:
Set up logging for “local6” with a new file:
And the contents…
Log out. Log in. Voila!
But I forgot about log rotation:
There is a list of log files to rotate the same way…
So add the new bash-commands log file in that list: