Skip to main content
Version: 2.0

Configuring user actions (operation) logging

This guide details the procedure for enabling real-time command logging for all users accessing the management node via the Bash shell. This is a critical security and compliance step that ensures every command executed by a user is recorded centrally in the system log, preventing users from clearing their activity trail.

🎯 Prerequisites​

  • Administrative (root) access to the management node.
  • The bash shell and rsyslog service must be installed and running (standard on most Linux distributions).

Configure real-time user history logging​

  1. Log into your cluster management shell as the root user.

  2. Create the Bash startup file to define the logging behavior. Files in the /etc/profile.d/ directory are automatically sourced (executed) for every user upon login.

  3. Create and edit the file with vi /etc/profile.d/bash_history_logging.sh.

  4. Enter i and paste the following content to ensure that user history is logged after each session.

    export PROMPT_COMMAND='history -a >(logger -t "bash_history[$USER]")'

  5. Verify the pasted content is the same as above. Press the ESC (escape) key and enter :wq to save and exit the file.

Configure System Log Handling (rsyslog)​

  1. Log into your cluster management shell as the root user.

  2. Create the rsyslog Configuration File

  3. Create a new configuration file in the /etc/rsyslog.d/ directory. Files here define custom logging rules.

    vi /etc/rsyslog.d/bash_history.conf

  4. Add the filtering rules by typing i to insert the content. Insert the following rule into the file. This rule targets all log messages tagged with "bash_history" and writes them to a specific log file.

    :syslogtag, startswith, "bash_history" /var/log/messages

  5. Save the contents by pressing the ESC (escape) key and entering :wq to save and exit the file.

  6. Restart the rsyslog Service Apply the new logging configuration by restarting the service:

    systemctl restart rsyslog

Verify user operation records​

  1. Perform Test Operations Log in as a standard, non-root user (e.g., userA). The new configuration from /etc/profile.d/ will apply.

    # Example test commands for userA
    date
    ls -l /tmp
    echo "Test complete"

  2. Review the Audit Log Log back in as root and verify that the executed commands, username, and PID have been logged in the new audit file.