How can I log all bash history commands to the syslog?

The Solution

  1. To log bash history to a syslog server, you can use the trap feature provided by Bash.
  2. To save this log messages into a particular log file, add below line in /etc/syslog.conf (for CentOS/RHEL 4/5) or /etc/rsyslog.conf (for CentOS/RHEL 6/7):
  3. Run below command to apply this change:

How do I see bash history?

The command is simply called history, but can also be accessed by looking at your . bash_history in your home folder. By default, the history command will show you the last five hundred commands you have entered.

Where is bash history stored?

home directory
In Bash, your command history is stored in a file ( . bash_history ) in your home directory.

How do you log all bash commands by all users on a server using Rsyslog?

How do I log all commands executed by all users

  1. Edit /etc/rsyslog.d/bash.conf : vim /etc/rsyslog.d/bash.conf. and add the following: local6.* /var/log/commands.log.
  2. Open /root/.bashrc : vim /root/.bashrc.
  3. Restart rsyslog service: sudo service rsyslog restart.

How do you audit all commands run in the system?

How to audit all Commands run on OEL 5,6 using auditd

  1. Use yum to install the audit package: # yum install audit.
  2. To start automatically the auditd service at boot time: # chkconfig auditd on.
  3. add the following lines to /etc/audit/audit. rules.
  4. Start the service:

How do I collect Syslogs?

To collect Syslogs:

  1. From Configuration tab > Event Sources, right-click an event source or group and select Properties.
  2. Click Syslog tab and select Accept Syslog messages to EventsManager to enable the collection of Syslogs from that event source/event source group.

How do I run syslog-ng?

Steps:

  1. Install the syslog-ng application on the host.
  2. Configure the local sources to collect the log messages of the host.
  3. Create a network destination that points directly to the syslog-ng server, or to a local relay.
  4. Create a log statement connecting the local sources to the syslog-ng server or relay.

How do you log all bash commands by all users on a server?