0

I am trying to create an audit file. I have seen you can use history to see what commands have been executed.

This can be modified to show the timestamps and other features such as blocking specific commands from being shown in tutorials, but I am finding it is not working as featured in the tutorials

adds time:

export HISTTIMEFORMAT='%F %T  '

supposed to remove ls, pwd, cd and date:

export HISTIGNORE='ls:pwd:date:cd:'

history output after entering these commands:

 2077  2020-04-30 11:47:25 export HISTIGNORE='ls:pwd:date:cd:'
 2078  2020-04-30 11:47:33 cd ..
 2079  2020-04-30 11:47:41 history
 2080  2020-04-30 11:48:25 cd a2
 2081  2020-04-30 11:48:32 cd a2
 2082  2020-04-30 11:48:38 history

Am I viewing dated tutorials or have I messed up the command?

0

Your cd commands are not ignored because your HISTIGNORE pattern contains only cd; the bash manual states, in part, for HISTIGNORE:

Each pattern is anchored at the beginning of the line and must match the complete line (no implicit ‘*’ is appended)

You might be interested in setting HISTIGNORE to include cd and cd * (as well as ls and ls *) to cover the cases you showed.

| improve this answer | |
-1

You can try:

  1. Open the /etc/profile in editable mode, since it is readonly.

  2. Define following two variables and save the file:

HISTTIMEFORMAT='%d-%m-%y %T '

HISTIGNORE='ls:pwd:date:cd'

  1. source /etc/profile

This applies globally, if you want only for your user then follow the same steps at ~/.bash_profile.

Good luck

| improve this answer | |
  • The OP gave no indication that /etc/profile was readonly. Perhaps you meant that it's usually owned by root? It's also not a good file to edit for local user customizations. Your ~/.bash_profile is the right file, but your proposal doesn't fix the issue. – Jeff Schaller May 1 at 13:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.