4 ms·
How To Log Bash History to Syslog
- atesti 15y agoWhat does history -a do? Seems to write the history to disc and not produce something to pipe into logger. How does this work?
- zooz 15y agoIt appends the "new" history lines to a $HISTFILE by default, unless other file is specified.
- atesti 15y agoThanks, that's what I was missing: -a can have a file. Cool stuff and thanks to all for explaining it. http://unixhelp.ed.ac.uk/CGI/man-cgi?history http://unixhelp.ed.ac.uk/CGI/man-cgi?history does not mention the command line argument, http://linux.die.net/man/1/bash http://linux.die.net/man/1/bash does.
- zooz 15y agoYou're welcome, it took me a bit of time to come up with this idea, of course, it's not perfect, but does the job pretty well.
- despite2 15y agoWith bash putting a command in <() uses the output of the command as though it were a file. I use it to diff the output of two commands: diff <(command 1) <(command 2) I've never used it, but I assume >() uses a command as though it were a writable file. So instead of history -a file writing to file, he does history -a >(logger) to write to the logger command. Seems pretty clever to me.
- zooz 15y agoYup, that's what it does. Shortly speaking <() or >() in bash that creates a temporary pipe.
- sciurus 15y agoIt's called process substitution. In this case it runs the logger command, connects its input to a file in /dev/fd, and places the name of that file in the argument list of history. I've included a small demonstration below. This is useful since the history command won't write to standard out so you can't use a normal pipe. It's more common to see process substitution used to gather output from multiple commands, see http://www.linuxjournal.com/content/shell-process-redirection http://www.linuxjournal.com/content/shell-process-redirectio... $ cat writer.sh #!/bin/bash if [[ "$#" == 1 ]]; then echo "Wrote to file named $1" > "$1" else echo "Wrote to stdout" fi $ ./writer.sh Wrote to stdout $ ./writer.sh | cat Wrote to stdout $ ./writer.sh >(cat) Wrote to file named /dev/fd/63
- giulivo 15y agothere is also a library intended to do this. snoopy logger, can easily be preloaded on linux to make it work without changing the existing applications https://github.com/renard/snoopylogger https://github.com/renard/snoopylogger
- LXicon 15y agoi would be a bit worried about accidental passwords getting into the syslog. i have typed passwords out of habit when they were not required or before a remote system responds only to have the password end up as a bash command. i then have to go into the .bash_history file and remove them.
- bitops 15y agoAgreed - folks who are logged in as root a lot seem to have an uncanny tendency to type all kinds of stuff that probably shouldn't show up in a log anywhere. These tend to be the same folks who think that using "sudo" is a waste of time and serves no purpose. Not that I've ever accidentally rebooted a box, of course. :P
- asharp 15y agoInteresting, but is there anything that can easily process syslog on the other end? ie. split data like this out into something useful?
- flyt 15y agoswatch or splunk or graylog2 http://www.graylog2.org/ http://www.graylog2.org/
- maratd 15y agoThis is a very cool solution! Unfortunately, it does not log the output of the command. For those that need to log absolutely everything, check out: https://github.com/jpschewe/rootsh https://github.com/jpschewe/rootsh rootsh is a wrapper shell for bash and logs everything.