1

Content in /var/log/messages

Jan 17 15:32:34 SERVER1 bash[146155]: user1 as root: ls -l
Jan 17 15:32:34 SERVER1 bash[146155]: user1 as root: cd

user1=who am i

root=whoami

ls -l and cd = $BASH_COMMANDS

SERVER1 = echo $HOST

bash[146155] =????

My output in my script:

Jan 17 15:32:34 SERVER1: user1 as root: ls -l

bash[id] is missing.

content of my script:

  1. if [ -n "${BASH_VERSION}" ]; then

  2. trap "caller >/dev/null || \

  3. printf '%s\n' \"\$(date '+%b %d %T')\

  4. \$(hostname -s) \$(logname) as \$(whoami): \${BASH_COMMAND}\" 2>/dev/null >>/var/log/messages" DEBUG

  5. fi

2
  • My script.. if [ -n "${BASH_VERSION}" ]; then trap "caller >/dev/null || \ printf '%s\\n' \"\$(date '+%b %d %T')\ \$(hostname -s) \$(logname) as \$(whoami): \${BASH_COMMAND}\" 2>/dev/null >>/var/log/messages" DEBUG fi
    – invinzin21
    Jan 24 '17 at 14:55
  • I am not sure I get your problem, despite its content, /var/log/messages is intended to be read by human, you can add any content.
    – Archemar
    Jan 25 '17 at 7:46
2

The bash[146155] in the logfile is the name of the process that sent the message to the log (in this case the bash shell) followed by the process ID (PID) of this process in square brackets.

The PID is included in the logfile so that an individual process may be identified. If a program misbehaves in some way, it may otherwise be hard to track what instance of the program it is that is acting up. This is particularly true for programs such as bash, java, sshd etc. that usually are executing in multiple processes on a system.

8
  • 2
    mere indication of programm name is not enough (there can be many "bash" or "java"), that's why pid is given in bracket.
    – Archemar
    Jan 24 '17 at 14:27
  • @Archemar Yes. I will add this.
    – Kusalananda
    Jan 24 '17 at 14:28
  • My question is every command that i type it gives me this bash[146155].. How can i reproduce that? other fields there is i can reproduce. But the bash with id?
    – invinzin21
    Jan 24 '17 at 14:51
  • You are the user who asked this question. You have your logging solution turned on maybe?
    – Kusalananda
    Jan 24 '17 at 14:54
  • Yes, I recreate the histlog.sh in /etc/profile.d , but what i am missing is the bash id.
    – invinzin21
    Jan 24 '17 at 14:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.