监控登陆用户的操作日志

将以下内容追加到/etc/profile后面

history
USER=`whoami`
USER_IP=`who -u am i 2>/dev/null| awk '{print $NF}'|sed -e 's/[()]//g'`
if [ "$USER_IP" = "" ]; then

USER_IP=`hostname`
fi
if [ ! -d /tmp/history ]; then
 mkdir /tmp/history
 chmod 777 /tmp/history
fi
if [ ! -d /tmp/history/${LOGNAME} ]; then
 mkdir /tmp/history/${LOGNAME}
 chmod 300 /tmp/history/${LOGNAME}
fi
export HISTSIZE=4096
DT=`date +"%Y-%m-%d_%H:%M:%S"`
export HISTFILE="/tmp/history/${LOGNAME}/${USER}@${USER_IP}_history.$DT"
chmod 600 /tmp/history/${LOGNAME}/*history* 2>/dev/null