Centos系统添加系统用户操作记录审计

按用户保存history命令历史
1.创建系统用户shell命令行操作记录日志存放位置
mkdir -p /var/log/userlogin/records/
chmod 777 /var/log/userlogin/records/
chmod +t /var/log/userlogin/records/

2.vim /etc/profile 在最后添加下面的代码
------------------------------------------------------------------------
if [ ! -d /var/log/userlogin/records/${LOGNAME} ]
then
mkdir -p /var/log/userlogin/records/${LOGNAME}
chmod 300 /var/log/userlogin/records/${LOGNAME}
fi

export HISTORY_FILE="/var/log/userlogin/records/${LOGNAME}/bash_history"

export PROMPT_COMMAND='{ date "+%Y-%m-%d %T ##### $(who am i |awk "{print \$1\" \"\$2\" \"\$5}") #### $(history 1 | { read x cmd; echo "$cmd"; })"; } >>$HISTORY_FILE'
------------------------------------------------------------------------
重新加载profile
source /etc/profile

3.测试验证
[root@localhost ~]# cd /var/log/userlogin/records/
[root@localhost records]# ls
root
[root@localhost records]# cd root/
[root@localhost root]# ls
bash_history
[root@localhost root]# cat bash_history