December 9

log all bash shell activity to separate file

log location:
echo 'local6.* /var/log/commands.log' >> /etc/rsyslog.d/bash.conf
add the following rule in the end of /etc/bashrc file:
export PROMPT_COMMAND='RETRN_VAL=$?; logger -p local6.debug "$(whoami) [$$]: $(history 1 | sed "s/^[ ]*[0-9]\\+[ ]*//" ) [$RETRN_VAL]"'

restart the service:

service rsyslog restart

done 🙂