Linux记录用户执行命令

#!/bin/bash
# By lumia98@vip.qq.com
# 记录用户执行命令及IP地址
# 登录提示权限不足可以忽略,因为这是禁止用户删除权限提示;
# Linux详细记录每个用户的执行命令
# 缺陷不能记录vim里的命令

# 文件存放在 /etc/profile.d 或者/etc/profile
# source /etc/profile 生效或者重启系统;

# 创建目录
hislog_dir="/tmp/hislog"
[ -d ${hislog_dir} ] || mkdir -p ${hislog_dir}

# 第一次请先赋予目录权限，方便普通用户也能记录
# chmod 777 ${hislog_dir}

# 创建存放日志文件
export HISTFILE="${hislog_dir}/$(date '+%F').his"
# 给这个文件最大权限，让普通账号的命令也能记录
# -x 判断文件是否有执行权限；-w 文件是否有写入权限; -r 文件是否有读取权限
[ -x  ${hislog_dir}/$(date '+%F').his  ] || chmod 777 -R ${hislog_dir}/$(date '+%F').his

# 权限(只能root用户可以查看),开启这个普通账号无法记录命令
#umask 000 $HISTFIE

#定义保存的命令日志文件
export HISTTIMEFORMAT='%F %T '
#定义命令日志格式
export PROMPT_COMMAND='user=$(who am i | sed "s/[ ][ ]*/ /g"); history 1 \
| { read x date time cmd; echo "${date} ${time} ${user} $(whoami) ${cmd}";} >> $HISTFILE'

# 禁止用户删除权限;取消sudo chattr -a
chattr +a -R ${hislog_dir}

# ${date} ${time} 当前操作命令时间
# ${user} 登录用户
# $(whoami) 当前执行命令的用户

记录的命令格式如下，截取了一小段

[root@test ~]# more /tmp/hislogs/2020-12-30.his 
2020-12-30 15:58:34 centos pts/1 2020-12-30 15:54 (12.21.13.24) centos su - root
2020-12-30 16:04:26 centos pts/1 2020-12-30 15:54 (12.21.13.24) centos ll
2020-12-30 16:04:26 centos pts/1 2020-12-30 15:54 (12.21.13.24) centos ll
2020-12-30 16:04:26 centos pts/1 2020-12-30 15:54 (12.21.13.24) centos ll
2020-12-30 16:04:36 centos pts/1 2020-12-30 15:54 (12.21.13.24) centos more /tmp/hislogs/2020-12-30.his
2020-12-30 16:04:44 centos pts/1 2020-12-30 15:54 (12.21.13.24) centos ls -ls
2020-12-30 16:04:45 centos pts/1 2020-12-30 15:54 (12.21.13.24) centos more /tmp/hislogs/2020-12-30.his
2020-12-30 16:04:49 centos pts/1 2020-12-30 15:54 (12.21.13.24) centos cd
2020-12-30 16:04:49 centos pts/1 2020-12-30 15:54 (12.21.13.24) centos cd
2020-12-30 16:05:09 centos pts/1 2020-12-30 15:54 (12.21.13.24) root ll
2020-12-30 16:05:15 centos pts/1 2020-12-30 15:54 (12.21.13.24) root vim /etc/profile.d/history.sh
2020-12-30 16:05:37 centos pts/1 2020-12-30 15:54 (12.21.13.24) root source  /etc/profile
2020-12-30 16:05:38 centos pts/1 2020-12-30 15:54 (12.21.13.24) root ll
2020-12-30 16:05:41 centos pts/1 2020-12-30 15:54 (12.21.13.24) root ll /tmp/
2020-12-30 16:05:43 centos pts/1 2020-12-30 15:54 (12.21.13.24) root ll /tmp/hislogs/