How can I make bash to log shell commands to syslog?

Question

Bash 4.1 is able to log the history to syslog. However I can't seem to make it work under FreeBSD 8.
I've tried re-compiling bash from ports with -DWITH_SYSLOG= but to no avail. Has anyone managed to get logging to work under FreeBSD? How about Linux?

http://sourceforge.net/projects/sudosh/ – dmourati Oct 12 '14 at 23:31 — dmourati, Oct 12 '14 at 23:31

score 3 · Accepted Answer · answered Oct 20 '11 at 14:30

3

The better thing to do would be to turn on auditing, which will let you record every command run regardless of what shell they're using.

answered Oct 20 '11 at 14:30

Wes Hardaker

774
5
6

1

How to turn on auditing ??? can you make a complete answer – medBouzid Feb 27 '20 at 13:08

score 2 · Answer 2 · edited Oct 12 '14 at 23:30

try this:

export HISTTIMEFORMAT="%Y-%m-%d %T "
export PROMPT_COMMAND='trap "" 1 2 15; history -a >(tee -a ~/.bash_history | while read line; do if [[ $line =~ ^#[0-9]*$ ]]; then continue; fi; logger -p user.info -t "bash[$$]" "($USER) $line"; done); trap 1 2 15;'

this does the logging AND it prevents logging of timestamps that are used for the bash history file. The trap is needed, since bash will send the signals to the "subjob" after pressing strg+c multiple times (tested with bash 4.3). this will force the logout of the current user (e.g. logged in with sudo)

How can I make bash to log shell commands to syslog?

2 Answers2

Linked