December
9
log all bash shell activity to separate file
log location:
echo 'local6.* /var/log/commands.log' >> /etc/rsyslog.d/bash.conf
add the following rule in the end of /etc/bashrc file:
export PROMPT_COMMAND='RETRN_VAL=$?; logger -p local6.debug "$(whoami) [$$]: $(history 1 | sed "s/^[ ]*[0-9]\\+[ ]*//" ) [$RETRN_VAL]"'
restart the service:
service rsyslog restart
done 🙂