从Linux服务器上的远程用户获取命令历史记录

Question

I have a Linux server and many users can access this by ssh . I need to get all history commands from users:

 - Date: the time of execution
 - Pwd: executable directory
 - Remote host ip
 - User
 - Command

Answer 1

It's too long to summarize here, but this blog post gives the code and description for setting up a system that logs everything that users do on a system:

Howto – bash audit / command logger

I've been using this personally for years and have found it invaluable.

As you requested, it logs date, time, current directory, user, and command. The IP address should be available in /var/log/auth.log

Update : Since writing the above, I put my 'fork' of this on GitLab: bash_franzi