mkdir -p /var/log/command_history/
touch /var/log/command_history/audit.log
chmod 222 /var/log/command_history/audit.log
chattr +a /var/log/command_history/audit.log
lsattr /var/log/command_history/audit.log
vi /etc/bashrc
# HISTORY
export HISTSIZE=100000
export HISTFILESIZE=100000
shopt -s histappend
export PROMPT_COMMAND="history -a ; $PROMPT_COMMAND"
# $(who -u am i | awk '{print $NF}'|sed -e 's/[()]//g')
#export HISTTIMEFORMAT="%F %T $(who am i |awk "{print \$1\" \"\$2\" \"\$5}") "
export HISTTIMEFORMAT="[$(date "+%F %T")] : [$SSH_CLIENT] : [$EUID $USER $SSH_TTY $(pwd)/] ---- $msg"
export HISTORY_FILE=/var/log/command_history/audit.log
export PROMPT_COMMAND='{ msg1=$(history 1 | { read x y; echo $y; });echo $msg1; } >> "$HISTORY_FILE"'
#export PROMPT_COMMAND='{ msg=$(history 1 | { read x y; echo $y; });echo [$(date "+%F %T")] : [$SSH_CLIENT] : [$EUID $USER $SSH_TTY $(pwd)/] ---- $msg; } >> "$HISTORY_FILE"'
exec $SHELL
