登录记录以及操作登记，每个用户登录的操作均被记录在日志！

在/etc/bashrc中追加以下内容

export HISTFILESIZE=10000000
export HISTSIZE=1000000
USER_IP=

who -u am i 2>/dev/null| awk '{print $NF}'|sed -e 's/[()]//g'

 
export HISTTIMEFORMAT="[%F %T][

whoami

][${USER_IP}] "
export PROMPT_COMMAND='\
if [ -z "$OLD_PWD" ];then
export OLD_PWD=$PWD;
fi;
if [ ! -z "$LAST_CMD" ] && [ "$(history 1)" != "$LAST_CMD" ]; then
logger -t

whoami

_shell_cmd "[$OLD_PWD]$(history 1)";
fi;
export LAST_CMD="$(history 1)";
export OLD_PWD=$PWD;'

执行source /etc/bashrc使之生效
随意执行几条命令，查看cat /var/log/messges是否有刚刚执行过的记录

方法二：

history
USER=

whoami

USER_IP=

who -u am i 2>/dev/null| awk  '{print $NF}'|sed -e 's/[()]//g'

if [ "$USER_IP" = "" ];then
USERIP=

hostname

fi
if [ ! -d /var/log/history ];then
mkdir /var/log/history
chmod 777 /var/log/history
fi
if [ ! -d /var/log/history/${LOGNAME} ];then
mkdir /var/log/history/${LOGNAME}
chmod 300 /var/log/history/${LOGNAME}
fi
export HISTSIZE=4096
DT=`date +"%Y%m%d%H:%M:%S"`
export HISTFILE="/var/log/history/${LOGNAME}/${USER}@${USERIP}$DT"
chmod 600 /var/log/history/${LOGNAME}/history 2>/dev/null

#保存在/etc/profile和~/.bashrc并source /etc/bashrc让他生效即可

随意执行几条命令，查看cat /var/log/history/是否有刚刚执行过的记录

参考博客：https://www.geek-share.com/detail/2690391492.html