记录登陆与操作日志

写在前面

记录登陆者的ip，登陆执行操作和登陆时间，登陆一次记录一次
原理是将命令写在/etc/profile里面，每次登陆都会加载/etc/profile文件，所以能够记录

手动创建

在/etc/profile文件后面加上下面代码init.txt

#登陆时运行
export LOGINLOGDIR=/home/LoginLog/history
#PS1="`whoami`@`hostname`:"'[$PWD]'
#export HISTTIMEFORMAT="%F %T"
#history
export HISTTIMEFORMAT="[%Y.%m.%d %H:%M:%S]"
USER_IP=`who -u am i 2>/dev/null| awk '{print $NF}'|sed -e 's/[()]//g'`

if [ "$USER_IP" = "" ]
then
USER_IP=`hostname`
fi

if [ ! -d ${LOGINLOGDIR} ]
then
    mkdir -p ${LOGINLOGDIR}
    chmod 733 ${LOGINLOGDIR}
fi

if [ ! -d ${LOGINLOGDIR}/${LOGNAME} ]
then
    mkdir ${LOGINLOGDIR}/${LOGNAME}
    chmod 300 ${LOGINLOGDIR}/${LOGNAME}
fi

if [ ! -d /home/LoginLog/bin/ ]
then
	mkdir /home/LoginLog/bin/ 
else
	/bin/bash /home/LoginLog/bin/Login.sh
fi
export HISTSIZE=4096
DT=`date +"%Y%m%d_%H%M%S"`
export LOGINDT=${LOGINLOGDIR}/LOGINLOG_`date +"%Y%m%d_%H%M"`
export HISTFILE="${LOGINLOGDIR}/${LOGNAME}/${USER_IP}_history.$DT"
chmod 600 ${LOGINLOGDIR}/${LOGNAME}/*history* 2>/dev/null

在/home/LoginLog/bin目录创建Login.sh

#!/bin/bash
MONTH=`date +"%Y%m"`
DAY=`date +"%d"`
HOUR=`date +"%H"`
MIN=`date +"%M"`
NOW=${MONTH}${DAY}_${HOUR}_${MIN}
LOGINLOGDIR=/home/LoginLog/history
LOGDIR=${LOGINLOGDIR}/${LOGNAME}/LOGIN

if [ ! -d ${LOGDIR} ]
then
mkdir -p ${LOGDIR}
fi
LOGFILE=${LOGDIR}/Loginlog_${NOW}.log
if [ ! -f ${LOGFILE} ]
then
touch  ${LOGFILE}
chmod 600 ${LOGFILE}
fi
echo "==============`date`=================">> ${LOGFILE}
last -x|head >> ${LOGFILE}

编写删除脚本DelLoginLog.sh

#!/bin/bash
#script name:DelLoginLog.sh
export LANG=en
LOGINLOGDELDIR=/home/LoginLog
LOGINLOGDIR=/home/LoginLog/history

#删除90天前的所有文件
find ${LOGINLOGDIR} -mtime +90 -type f|xargs rm -f

#读取日志文件大小
FREEDISK=`du -sk ${LOGINLOGDELDIR}/|awk '{print $1}'`

function DiskClear()
{
    #查找1天前的最早的10个文件
    HEADMOST=`find ${LOGINLOGDELDIR} -mtime +1 -type f|xargs ls -lrt|awk '{print $NF}'|egrep -v "total$|sh$|tmp$|^snapshot$"|head -n 10`;
    #如果文件数为0，则退出函数
    HEADCOUNT=`find ${LOGINLOGDELDIR} -mtime +1 -type f|egrep -v "total$|sh$|tmp$|^snapshot$"|wc -l`;
    [ "${HEADCOUNT}" == '0' ] && return; 
    rm -f "$HEADMOST";
    FREEDISK=`du -sk ${LOGINLOGDIR}/|awk '{print $1}'`;
    if [ "${FREEDISK}" -ge "102400" ];then
        DiskClear;
    fi; 
}

# 当文件大于1G时删除
if [ "${FREEDISK}" -ge "102400" ];then
    DiskClear
fi
#删除空文件夹
EMPTYDIRCOUNT=`find ${LOGINLOGDELDIR} -type d -empty|wc -l`
if [ $EMPTYDIRCOUNT != '0' ];then  
        find ${LOGINLOGDELDIR} -type d -empty|xargs rmdir -p --ignore-fail-on-non-empty
fi

备份并上传脚本LoginLogBakup.sh — —目前没部署

#!/bin/bash
BAKUPDIR=/home/LoginLog/Bak
LOGINLOGDIR=/home/LoginLog/history
MONTH=`date +"%Y%m"`
DAY=`date +"%d"`
HOUR=`date +"%H"`
MIN=`date +"%M"`
NOW=${MONTH}${DAY}_${HOUR}_${MIN}
BAKUPFILE=${BAKUPDIR}/backup_${NOW}.tar.gz



if [ ! -d ${BAKUPDIR} ];then
	mkdir -p ${BAKUPDIR}
fi

cd ${BACUPDIR}
tar -g snapshot -zcf ${BAKUPFILE} ${LOGINLOGDIR}
##############################ftp#########################################
FTPlog=${BAKUPDIR}/ftp_`date +%Y-%m-%d`.log
TOHOST=
HOSTPORT=
USER=
PASSWORD=
TODIR=
echo "`date +%Y-%m-%d' '%H:%M:%S`,***FTP***Begin to put files....."  >> $FTPlog


/usr/bin/ftp  -n << !  > /dev/null
open ${TOHOST} ${HOSTPORT}
user ${USER} ${PASSWORD}
binary
cd ${TODIR}
put ${BAKUPFILE} ${BAKUPFILE}.$
rename ${BAKUPFILE}.$ $BAKUPFILE
bye
!

if [ $? = 0 ]; then
  echo "`date +%Y-%m-%d' '%H:%M:%S`,***FTP***put    $i sucess...." >> $FTPlog
else
    echo "`date +%Y-%m-%d' '%H:%M:%S`,***FTP***put    $i failed...." >> $FTPlog
fi

echo "`date +%Y-%m-%d' '%H:%M:%S`,***FTP***End to put files....."  >> $FTPlog

修改脚本权限

在crontab -e中添加定时任务

将DelLoginLog.sh和LoginLogBakup.sh脚本加入定时任务

*/5 * * * * /bin/bash /home/LoginLog/bin/DelLoginLog.sh

要读取历史日志时间时执行下面代码进行时间格式转换

FILENAME=192.168.153.1_history.20160524_205143
perl -i -pe 's/^#(\d+)$/localtime($1)/e' ${FILENAME}

注意

• 新建目录和文件时注意权限
  • 脚本权限要加x ：chmod a+x **.sh
  • $LOGINLOGDIR 目录权限要可写可执行，可以不给其他用户读取权限：chmod 733

自动创建

####自动安装脚本setup.sh

#!/bin/bash
## 检查 root 权限
[ $(id -g) != "0" ] && die "Script must be run as root.";

cat ./init.txt >> /etc/profile

logdir=/home/LoginLog
LOGINLOGDIR=${logdir}/history

if [ ! -d ${logdir} ]
then
    mkdir -p ${logdir}
    chmod 733 ${logdir}
fi

if [ ! -d ${LOGINLOGDIR} ]
then
    mkdir -p ${LOGINLOGDIR}
    chmod 733 ${LOGINLOGDIR}
fi

if [ ! -d ${logdir}/bin/ ]
then
    mkdir ${logdir}/bin/
fi

chmod 744 ./bin/*.sh
chmod a+x ./bin/Login.sh
cp ./bin/*.sh ${logdir}/bin/
#添加定时任务
echo "5 3 * * * /bin/bash ${logdir}/bin/DelLoginLog.sh" >> /var/spool/cron/root

注意：在安装脚本目录执行安装脚本

打包文件内容清单

autosetup.tar.gz
|--autosetup/
	|--bin/
		|--DelLoginLog.sh
		|--Login.sh
	|--init.txt
	|--setup.sh

autosetup.tar.gz

注意

首次执行完要exit退出，