enhancing user activity tracking 1

[Birbone]

Help is needing in enhancing user activity tracking. Please check out Thread51-418939 in the HP-UNIX forum. -B
birbone@earthlink.net

 

[marsd]

Not tested. Should give you an idea and needs polishing.

-----------------------------------------------
#!/usr/bin/tclsh

set logfile [open "mylogfile" "a+"]
set userfile_pat "/home/*/.sh_hist*"

proc cpbadUser {} {
global logfile userfile_pat
foreach pat [glob -nocomplain $userfile_pat] {
if {[file isfile $pat] && [file size $pat] >= 100} {
tclTail $pat 100 $logfile
}
}
after 300000 [list cpBadUser]
}

proc tclTail {fn sz chan} {
if {![eof $chan] && ![catch {set fd [open $fn "r"]}]} {
seek [expr [file size $pat] - $sz] start
puts $chan [read $fn $sz]
close $fn
return 1
}
puts "Error:Accessing or opening $fn"
return 0
}

cpbadUser
vwait forever
----------------------------------------------

Now you have a user shell_history logging daemon
by: tclsh scriptname&

 

[Birbone]

I am going to have to play with that one and compare it to doing a logger command or appending a specified filename with a "tail -f" of the users sh_history file. Logger writes output to the syslog.

tail -f ~username/.sh_history |while read line
do
logger $LOGNAME":"$line
done

Note: special thanks goes to Micheal from an HP forum for his direction on using logger. -B
birbone@earthlink.net

 

[marsd]

Pure shell with logger or tail will work also, and a lot
less fuss. I was in tcl mode today, sorry.

 

[Birbone]

No need to apologize, I love learning different ways to accomplish the same task. I learned to expand, because just one way doesn't always work. What's tcl mode? -B
birbone@earthlink.net

 

[marsd]

That's when every question you see seems to be something
tcl was made to solve ;-)