How to log all Bash commands by all users on a server?


As described here.

For BASH shells, edit the system-wide BASH runtime config file:

sudo -e /etc/bash.bashrc

Append to the end of that file:

export PROMPT_COMMAND='RETRN_VAL=$?;logger -p local6.debug "$(whoami) [$$]: $(history 1 | sed "s/^[ ]*[0-9]\+[ ]*//" ) [$RETRN_VAL]"'

Set up logging for “local6” with a new file:

sudo -e /etc/rsyslog.d/bash.conf

And the contents…

local6.*    /var/log/commands.log
& ~

The “& ~” keeps the commands from also going into syslog.
Restart rsyslog:

sudo service rsyslog restart

How to set up log rotation:

sudo -e /etc/logrotate.d/rsyslog

There is a list of log files to rotate the same way…

/var/log/mail.warn
/var/log/mail.err
[…]
/var/log/message

So add the new bash-commands log file in that list:

/var/log/commands.log

Save.

Leave a Reply

Your email address will not be published. Required fields are marked *