# 用户操作记录监控

![](https://2790782217-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F1B0zycoBrU18tXqA0db8%2Fuploads%2FgKDmnDGTaVINFWfkzTGZ%2Fimage.png?alt=media\&token=5fb762ad-92c3-472f-b6e3-4c2360a5e2d1)

服务器操作记录

```bash
#!/bin/bash
touch /var/log/check_user_history.log
chown nobody.nobody /var/log/check_user_history.log
chmod 002 /var/log/check_user_history.log
chattr +a /var/log/check_user_history.log
cat >> /etc/profile << "EOF"
export HISTORY_FILE=/var/log/check_user_history.log
export PROMPT_COMMAND='{ date "+%Y-%m-%d %T ##### USER:$USER IP:$SSH_CLIENT PS:$SSH_TTY ppid=$PPID pwd=$PWD #### $(history 1 | { read x cmd; echo "$cmd"; })";} >>$HISTORY_FILE'
EOF
source /etc/profile
```