運維中，我們有時候想要記錄伺服器上誰登入了、幹了什麼，前者可以使用之前的ssh登入報警這篇文章，後者則可以參考本文。

此功能利用的是history命令、PROMPT_COMMAND環境變數、/etc/profile.d/擴充套件全域性環境變數，Linux中的PROMPT_COMMAND會記錄下出現提示符前面的命令，利用這個特性可以實現記錄所有使用者的操作記錄。

環境：

    centos6、7，要求安裝iproute(yum install iproute)

原理：

    自定義history和PROMPT_COMMAND相關環境變數，放到/etc/profile.d/中令全域性生效，記錄所有使用者的命令操作。

步驟：

    1. 將以下程式碼儲存到/etc/profile.d/cmdhistLog.sh

# bash cmd audit
# root touch $HISTFILE && chmod a+w $HISTFILE, yum install iproute
readonly HISTSIZE=10000
readonly HISTFILESIZE=10000
readonly HISTFILE=/tmp/XingkaOpsCmdHist.log
readonly SERVER_IPS=$(/usr/sbin/ip a | grep inet | grep -v inet6 | grep -v 127 | sed 's/^[ \t]*//g'
 
 | cut -d ' ' -f2 | awk -F '/' '{print $1}' | xargs | sed 's/\s/,/g')
readonly PROMPT_COMMAND='{ \
if [ -z "$OLD_PWD" ];then
    export OLD_PWD=$PWD;
fi;
if [ ! -z "$LAST_CMD" ] && [ "$(history 1)" != "$LAST_CMD" ]; then
    msg=$(history 1 | { read x y; echo $y; });echo [$(date +"%Y-%m-%d %H:%M:%S")] [\($USER\) $(who am i |awk "{print \$1\" \"\$2\" \"\$NF}" | sed -e "s/[()]//g")] [$(hostname)@$SERVER_IPS] "$msg" >> $HISTFILE;
fi;
export LAST_CMD="$(history 1)";
export OLD_PWD=$PWD; }'
 

shopt -s histappend
export HISTSIZE HISTFILESIZE HISTFILE PROMPT_COMMAND

    2. 上述儲存後，重新登入的終端即可生效，建議手動建立下日誌檔案，並需要授予所有人可寫許可權

# $HISTFILE改為實際日誌檔案路徑
touch $HISTFILE && chmod a+w $HISTFILE

    3. 使用python清洗日誌，篩選出有效的命令資料並上報給運維平臺、資料庫等

    # PS: 指令碼可能需要根據實際情況自行修改。

#!/usr/bin/python
# coding: utf8
# Author: taochengwei
# Email: [email protected]
# Date: 2018-12-11
# Docs: Command the audit log report

import os
import re
import sys
import stat
import json
import urllib
import urllib2
import traceback
reload(sys)
sys.setdefaultencoding('utf-8')

log = os.getenv('HISTFILE', '/tmp/XingkaOpsCmdHist.log')
pat = re.compile(r'^(\[.*\])\s(\[.*\])\s(\[.*\])\s(.*)$')
if not os.path.isfile(log):
    with open(log, "w") as f:
        f.write("")
    os.chmod(log, stat.S_IWUSR+stat.S_IRUSR+stat.S_IRGRP+stat.S_IWGRP+stat.S_IWOTH)


def post(url, data, token=None):
    """ POST請求 """
    if isinstance(data, dict):
        data = urllib.urlencode(data)  # 將字典以url形式編碼
    headers = {'AccessToken': token} if token else {}
    headers.update({"User-Agent": "Mozilla/5.0 (X11; CentOS; Linux i686; rv:7.0.1406) Gecko/20100101 OpsRequestBot/0.1", "Content-Type": "application/json"})
    request = urllib2.Request(url, data=data, headers=headers)
    response = urllib2.urlopen(request)
    response = response.read()
    try:
        data = json.loads(response)
    except Exception, e:
        traceback.print_exc()
        data = response
    return data


if __name__ == "__main__" and log and os.path.isfile(log):
    access_token = ""
    # read log
    with open(log, 'rb') as f:
        data = f.read()
    os.chmod(log, stat.S_IWUSR+stat.S_IRUSR+stat.S_IRGRP+stat.S_IWGRP+stat.S_IWOTH)
    # set post data pool
    # pool 是篩選後的有效命令資料，是一個列表，可以上報到運維平臺或寫入資料庫中
    pool = []
    for cmd in data.split("\n"):
        if pat.match(cmd):
            cmd = [i for i in pat.split(cmd) if i]
            if cmd and isinstance(cmd, (list, tuple)) and len(cmd) == 4:
                try:
                    # Time to execute the command
                    ctime = cmd[0].lstrip('[').rstrip(']')
                    # Switch user, real login user, terminal for pts or tty, client ip
                    suser, luser, terminal, clientIp = cmd[1].lstrip('[').rstrip(']').split()
                    suser = suser.replace('(', '').replace(')', '')
                    # the server hostname and all ip
                    hostname, serverIps = cmd[2].lstrip('[').rstrip(']').split('@')
                    # real bash command
                    command = cmd[3]
                except Exception, e:
                    traceback.print_exc()
                    print cmd
                else:
                    pool.append(dict(ctime=ctime, suser=suser, luser=luser, terminal=terminal, clientIp=clientIp, hostname=hostname, serverIps=serverIps, command=command))
    # post data with pool
    res = post("接收上報的運維平臺介面地址", json.dumps(pool), access_token)
    if res["code"] == 0:
        with open(log, "w") as f:
            f.write("")
    print(res)

    4. 後端處理

    # 這是後端運維平臺的介面路由函式，它接收命令審計資料，並用非同步任務寫入資料庫
    def serverCmdHist(self, data):
        """伺服器歷史命令記錄"""
        res = dict(code=1, msg=None)
        if data and isinstance(data, (list, tuple)):
            # 需要進一步篩選有效條目
            pool = []
            for log in data:
                if log and isinstance(log, dict) and \
                        "ctime" in log and \
                        "serverIps" in log and \
                        "hostname" in log and \
                        "terminal" in log and \
                        "command" in log and \
                        "suser" in log and \
                        "luser" in log and \
                        "clientIp" in log:
                    # check log params
                    try:
                        if not user_pat.match(log["luser"]) or not ip_check(log["clientIp"]) or not log["hostname"] or not log["command"]:
                            raise
                        datetime_to_timestamp(log["ctime"])
                    except:
                        pass
                    else:
                        # 此處生成一條有效命令唯一標識，避免誤提交審計日誌時重複寫入資料庫
                        log.update(oci=md5("%s-%s-%s-%s-%s" %(log["hostname"], log["ctime"], log["luser"], log["suser"], log["command"])))
                        pool.append(log)
            # 此處pool中的命令記錄都應該是有效的，放到非同步任務中寫入到mysql
            self.asyncQueueHigh.enqueue_call(func=ServerCmdHist2MySQL, args=(pool,), timeout=3600)
            res.update(code=0)
        else:
            res.update(msg="data error")
        return res

    5. 資料庫表結構

CREATE TABLE `servercmdhist` (
  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
  `oci` char(32) NOT NULL COMMENT '命令唯一標識',
  `hostname` varchar(150) NOT NULL COMMENT '主機名',
  `serverIps` varchar(255) DEFAULT NULL COMMENT '主機ip',
  `ctime` char(19) NOT NULL COMMENT '命令執行的時間',
  `luser` varchar(32) NOT NULL COMMENT '實際登入的使用者',
  `suser` varchar(32) DEFAULT NULL COMMENT '實際使用者切換後的使用者',
  `terminal` varchar(50) DEFAULT NULL COMMENT '登入終端型別',
  `clientIp` varchar(15) NOT NULL COMMENT '登入來源ip',
  `command` varchar(10000) NOT NULL COMMENT '執行的命令',
  PRIMARY KEY (`id`),
  UNIQUE KEY `oci` (`oci`),
  KEY `hostname` (`hostname`)
) ENGINE=InnoDB AUTO_INCREMENT=1 DEFAULT CHARSET=utf8;

原文：https://blog.saintic.com/blog/264.html