rsyslog.conf 配置修改

# Save history message to hist.log
local5.debug                                            /var/log/hist.log

hist 配置

##hist_log
export PROMPT_COMMAND='{ msg=$(history 1 | { read x y; echo $y; }); logger -p local5.debug "$HOSTNAME [HIST] : $SSH_CLIENT : $PWD : $msg"; }'
export HISTTIMEFORMAT="[%F %T]"
#export PROMPT_COMMAND="history -a"

export PS1='\[\033[1;33;1m\][\[\033[0;32;1m\]\u@\h \[\033[1;33;1m\]\W\[\033[1;33;1m\]]\[\033[1;33;1m\]\$\[\033[0m\]'

hist 日志切割

/etc/logrotate.d/hist
/var/log/hist.log {
#     weekly
    daily
    missingok
    notifempty
    rotate 12
    compress
    delaycompress
    dateext
    create 0600 root root
    sharedscripts
    postrotate
    /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
    endscript
}

重启rsyslog 服务

systemctl restart rsyslog