:wall:i'm system administrator. now i have a trouble. i want to fetch the command which the login users performed by shell.but i don't know how to process this problem.if anyone tell me how to do this work I would be very grateful.thank you!
Why not check the .sh_history file in each users home directory?
--ahamed
You may or may not be able to get such information. Depends on whether the user's shell supports history - for example, the Bourne shell does not, the user has history support turned on, and whether the user clears out history before logging off.
Some shells such as Korn Shell 93 have a command logging facility which enables you to log all commands entered by a user to a logging server. Bash/Dash/Ash do not have such a facility.
Couple of ways to do it.
-
Change the user login shell to your own crafted shell that 'script(1)' the user terminal
-
Run dtrace (available in solaris 10). You may want to use Brendan Gregg's execsnoop:
http://www.brendangregg.com/DTrace/execsnoop
Whichever way you use, be ethical
Thank you for your reply.