From owner-freebsd-isp@FreeBSD.ORG  Fri Jun 18 14:00:27 2004
Return-Path: <owner-freebsd-isp@FreeBSD.ORG>
Delivered-To: freebsd-isp@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id AACEA16A4CF
	for <freebsd-isp@freebsd.org>; Fri, 18 Jun 2004 14:00:27 +0000 (GMT)
Received: from mail1.firstlink.com (mail1.firstlink.com [66.37.141.14])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 82DBD43D31
	for <freebsd-isp@freebsd.org>; Fri, 18 Jun 2004 14:00:27 +0000 (GMT)
	(envelope-from dvm@firstlink.com)
Received: from [172.31.31.66] (66-37-143-133.corp.firstlink.com
	[66.37.143.133])
	by mail1.firstlink.com (Postfix) with ESMTP id A4B10EC312;
	Fri, 18 Jun 2004 07:59:37 -0600 (MDT)
From: Dan Vande More <dvm@firstlink.com>
To: Andrew Nelson <andrew__nelson@hotmail.com>
In-Reply-To: <BAY18-F66hIqU7MOKZv0001212c@hotmail.com>
References: <BAY18-F66hIqU7MOKZv0001212c@hotmail.com>
Content-Type: text/plain
Message-Id: <1087567158.1401.4.camel@dvmgentoo>
Mime-Version: 1.0
X-Mailer: Ximian Evolution 1.4.6 
Date: Fri, 18 Jun 2004 07:59:18 -0600
Content-Transfer-Encoding: 7bit
cc: freebsd-isp@freebsd.org
Subject: Re: monitoring shell commands (recording username/cmd/time)
X-BeenThere: freebsd-isp@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
Reply-To: dvm@firstlink.com
List-Id: Internet Services Providers <freebsd-isp.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-isp>,
	<mailto:freebsd-isp-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-isp>
List-Post: <mailto:freebsd-isp@freebsd.org>
List-Help: <mailto:freebsd-isp-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-isp>,
	<mailto:freebsd-isp-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 18 Jun 2004 14:00:27 -0000

On Thu, 2004-06-17 at 21:22, Andrew Nelson wrote:
> I'm wondering if there is a version of bash or tcsh that logs all commands
> to a file with username and time?   I've tried Sudo, but it's not all that
> practical for my purpose (I'm not that interested in restricting access, 
> just
> seeing who has done what at which time...)   Can anyone help?

Yeah, there is a BOFH patch for bash, you can get from here:

http://www.ccitt5.net/archives/

It produces syslog messages like this:

Jun 17 23:50:02 server bash[12725]: [user1] cd 
Jun 17 23:50:02 server bash[12725]: [user1] ll
Jun 17 23:50:08 server bash[12725]: [user1] vi foo.txt
Jun 17 23:50:58 server bash[11642]: [user1] vi bar.txt


HTH!

-Dan