How To Log Bash History to Syslog

http://jablonskis.org/2011/howto-log-bash-history-to-syslog/

by clyfe • 15 years ago

50 13 15 years ago

atesti2• 15 years ago

What does history -a do? Seems to write the history to disc and not produce something to pipe into logger. How does this work?

zooz3• 15 years ago

It appends the "new" history lines to a $HISTFILE by default, unless other file is specified.

atesti2• 15 years ago

Thanks, that's what I was missing: -a can have a file. Cool stuff and thanks to all for explaining it. http://unixhelp.ed.ac.uk/CGI/man-cgi?history does not mention the command line argument, http://linux.die.net/man/1/bash does.

despite2• 15 years ago

With bash putting a command in <() uses the output of the command as though it were a file. I use it to diff the output of two commands: diff <(command 1) <(command 2)

I've never used it, but I assume >() uses a command as though it were a writable file. So instead of history -a file writing to file, he does history -a >(logger) to write to the logger command. Seems pretty clever to me.

zooz3• 15 years ago

Yup, that's what it does. Shortly speaking <() or >() in bash that creates a temporary pipe.

sciurus• 15 years ago

It's called process substitution. In this case it runs the logger command, connects its input to a file in /dev/fd, and places the name of that file in the argument list of history. I've included a small demonstration below. This is useful since the history command won't write to standard out so you can't use a normal pipe. It's more common to see process substitution used to gather output from multiple commands, see http://www.linuxjournal.com/content/shell-process-redirectio...

    $ cat writer.sh 
    #!/bin/bash
    if [[ "$#" == 1 ]]; then
        echo "Wrote to file named $1" > "$1"
    else
        echo "Wrote to stdout"
    fi

    $ ./writer.sh 
    Wrote to stdout

    $ ./writer.sh | cat
    Wrote to stdout

    $ ./writer.sh >(cat)
    Wrote to file named /dev/fd/63

giulivo• 15 years ago

there is also a library intended to do this. snoopy logger, can easily be preloaded on linux to make it work without changing the existing applications

https://github.com/renard/snoopylogger

LXicon• 15 years ago

i would be a bit worried about accidental passwords getting into the syslog. i have typed passwords out of habit when they were not required or before a remote system responds only to have the password end up as a bash command. i then have to go into the .bash_history file and remove them.

bitops• 15 years ago

Agreed - folks who are logged in as root a lot seem to have an uncanny tendency to type all kinds of stuff that probably shouldn't show up in a log anywhere.

These tend to be the same folks who think that using "sudo" is a waste of time and serves no purpose. Not that I've ever accidentally rebooted a box, of course. :P

asharp• 15 years ago

Interesting, but is there anything that can easily process syslog on the other end? ie. split data like this out into something useful?

flyt• 15 years ago

swatch or splunk or graylog2

http://www.graylog2.org/

maratd• 15 years ago

This is a very cool solution!

Unfortunately, it does not log the output of the command. For those that need to log absolutely everything, check out:

https://github.com/jpschewe/rootsh

rootsh is a wrapper shell for bash and logs everything.

How To Log Bash History to Syslog

Related Stories