.sh_history

[saucyboy]

guys

how do i rotate this file, i have been told i can't
cp away the file then null it as it will corrupt it...

if it is corrupted how do i recreate it correctly, so it logs correctly

thanx

 

[Gloups]

script something to execute by cron like:


cp ~.sh_history to /mydir/sh_history_weekXX

>~.sh_history

to clean the file

 

[saucyboy]

hi

the command > ~.sh_history does not work, it just gives me a file name "~.sh_history" with 0 bytes

any ideas

 

[p5wizard]

You have to run both commands (first one save the file somewhere, second one starts a fresh file)

for completeness:
[tt]WK=$(date +'%W')
cp ~.sh_history /savedir/sh_history_week${WK}
> ~.sh_history[/tt]


HTH,

p5wizard

 

[columb]

It's not quite what you're asking about but we use an entry in /etc/profile which looks like

tty >/dev/null 2>&1 && { \
  export HISTFILE=/var/hist/$(who am i|awk '{print $1}')_pts$(basename $(tty))_$(date +"%d.%m.%y"); \
  touch $HISTFILE 2>/dev/null; \
  chmod 666 $HISTFILE 2>/dev/null; \
  export HISTSIZE=50000; }

This creates a history file of up to 50,000 lines which is guaranteed unique to the user and login. The historyu file for oracle logged in on the 15th on pts10 is called oracle_pts10_15.10.07. The history is kept across su and within reason can be used to check who did what (Ok, anyone can clear their history file but, if you're looking for bad guys that in itself is suspicious)

I then use a standard find command to housekeep /var/hist

Ceci n'est pas une signature
Columb Healy

 

[saucyboy]

Hi

this is bizzare, icopied away .sh_history
and then issued the cmd > ~.sh_history
but the file size is still the same...

 

[p5wizard]

That is because your shell process still has the file open for appending at a specific byte offset.

The idea is to run that copying/restart script in background (cron?) or perhaps during your shell startup (in ~/.profile)



HTH,

p5wizard