Earlier quoted context omitted.
It appends the "new" history lines to a $HISTFILE by default, unless other file is specified.
Thanks, that's what I was missing: -a can have a file. Cool stuff and thanks to all for explaining it. http://unixhelp.ed.ac.uk/CGI/man-cgi?history does not mention the command line argument, http://linux.die.net/man/1/bash does.
How To Log Bash History to Syslog
11–14 of 14 posts
You're welcome, it took me a bit of time to come up with this idea, of course, it's not perfect, but does the job pretty well.
Re: How To Log Bash History to Syslog
#12This is a very cool solution!
Unfortunately, it does not log the output of the command. For those that need to log absolutely everything, check out:
https://github.com/jpschewe/rootsh
rootsh is a wrapper shell for bash and logs everything.
Re: How To Log Bash History to Syslog
#13What does history -a do? Seems to write the history to disc and not produce something to pipe into logger. How does this work?
With bash putting a command in I've never used it, but I assume >() uses a command as though it were a writable file. So instead of history -a file writing to file, he does history -a >(logger) to write to the logger command. Seems pretty clever to me.
It's called process substitution. In this case it runs the logger command, connects its input to a file in /dev/fd, and places the name of that file in the argument list of history. I've included a small demonstration below. This is useful since the history command won't write to standard out so you can't use a normal pipe. It's more common to see process substitution used to gather output from multiple commands, see http://www.linuxjournal.com/content/shell-process-redirectio...
$ cat writer.sh
#!/bin/bash
if [[ "$#" == 1 ]]; then
echo "Wrote to file named $1" > "$1"
else
echo "Wrote to stdout"
fi
$ ./writer.sh
Wrote to stdout
$ ./writer.sh | cat
Wrote to stdout
$ ./writer.sh >(cat)
Wrote to file named /dev/fd/63Re: How To Log Bash History to Syslog
#14Interesting, but is there anything that can easily process syslog on the other end? ie. split data like this out into something useful?
swatch or splunk or graylog2