Re: Feature Request re: syslog and bashhist

[Ondrej Oprala]

On 10.08.2015 22:19, Chet Ramey wrote:
> On 8/9/15 1:37 PM, aixtools wrote:
> > Hi,
> >
> > Via google I came across the define named
> >
> > config-top.h:/* #define SYSLOG_HISTORY */
> >
> > Changing it (manually) to
> > config-top.h:#define SYSLOG_HISTORY
> >
> > Adds syslog statements such as:
> > Aug  9 16:52:55 x064 user:info syslog: HISTORY: PID=262242 UID=0 ls -ltr
> >
> > Request #1
> > Add a ./configure variable, e.g., --with-syslog_history
> I will think about this, but I am inclined not to do it.  It's easy enough
> to enable for those few user who want to do so.
>
> > Request #2
> >
> > At the request of a bash user on AIX I made the following change to make
> > the syslog output "standardized" to AIX format for many applications so
> > that the output looks like this:
> >
> > Aug  9 17:30:12 x064 user:info syslog: bash[454682]: UID=0: ls -ltr
> The better way to do this is to use openlog().  I will add the necessary
> pieces to call openlog with the shell name as the identifier and LOG_PID
> as the default value for the log options.
>
> Chet
We have recently had a customer request for this, and Steve Grubb corrected
the original patch for auditing. IIRC, aureport-2.4.2 should be able to 
handle the USER_TTY
events now. With his permission, I'm attaching the new patch.
 Thanks
   Ondrej

bash-4.3-audit2.patch
Description: Text Data