# Configuring user actions (operation) logging

> Learn how to configure user action logging for compliance and security monitoring.

This guide details the procedure for enabling real-time command logging for all users accessing the management node via the Bash shell. This is a critical security and compliance step that ensures every command executed by a user is recorded centrally in the system log, preventing users from clearing their activity trail.

## 🎯 Prerequisites {#-prerequisites}

- Administrative (**root**) access to the management node.
- The `bash` shell and `rsyslog` service must be installed and running (standard on most Linux distributions).

## Configure real-time user history logging {#configure-real-time-user-history-logging}

1. Log into your cluster management shell as the `root` user.
2. Create the Bash startup file to define the logging behavior. Files in the `/etc/profile.d/` directory are automatically sourced (executed) for every user upon login.
3. Create and edit the file with `vi /etc/profile.d/bash_history_logging.sh`.
4. Enter `i` and paste the following content to ensure that user history is logged after each session.

   ```ini
   export PROMPT_COMMAND='history -a >(logger -t "bash_history[$USER]")'
   ```

5. Verify the pasted content is the same as above. Press the `ESC` (escape) key and enter `:wq` to save and exit the file.

## Configure System Log Handling (rsyslog) {#configure-system-log-handling-rsyslog}

1. Log into your cluster management shell as the `root` user.
2. Create the rsyslog Configuration File
3. Create a new configuration file in the /etc/rsyslog.d/ directory. Files here define custom logging rules.

   ```bash
   vi /etc/rsyslog.d/bash_history.conf
   ```

4. Add the filtering rules by typing `i` to insert the content.
   Insert the following rule into the file. This rule targets all log messages tagged with "bash_history" and writes them to a specific log file.

   ```ini
   :syslogtag, startswith, "bash_history" /var/log/messages
   ```

5. Save the contents by pressing the `ESC` (escape) key and entering `:wq` to save and exit the file.
6. Restart the rsyslog Service
   Apply the new logging configuration by restarting the service:

   ```ini
   systemctl restart rsyslog
   ```

## Verify user operation records {#verify-user-operation-records}

1. Perform Test Operations
   Log in as a standard, non-root user (e.g., userA). The new configuration from /etc/profile.d/ will apply.

   ```ini
   # Example test commands for userA
   date
   ls -l /tmp
   echo "Test complete"
   ```

2. Review the Audit Log
   Log back in as root and verify that the executed commands, username, and PID have been logged in the new audit file.