I would like to modify the history settings for all users on the systems that I manage.I would like it to contain the information from the connecting terminal like from whosysadmin:/ # whosysadmin  pts/0        Mar 26 07:11 (sysadmin.doofus.local)I currently modify my history in the following ways. I know that many of these settings have been covered here several times. However, I pulled this code from Linux System Administration Recipes by: Juliet Kemp long ago.shopt -s histappendPROMPT_COMMAND='history -n;history -a'HISTSIZE=100000HISTFILESIZE=100000HISTTIMEFORMAT=%m/%d/%y %T  shopt -s histappend fixes problem when you have multiple terminals open information may be lost.PROMPT_COMMAND='history -n;history -a' extends to give real-time appending to history across multiple terminals.HISTSIZE=100000HISTFILESIZE=100000extends the amount of history retentionHISTTIMEFORMAT=%m/%d/%y %T   prefaces each line of history with a time stampWhat you typically get with  history835  ls836  cd ..My modified current history results5853  03/26/12 07:16:49  ls5854  03/26/12 07:16:50  llThe return from history I would like to see5853  03/26/12 07:16:49  sysadmin.doofus.local    ls5854  03/26/12 07:16:50  sysadmin.doofus.local    ll001  03/26/12 05:11:29  demo_user.doofus.local    cd002  03/26/12 05:11:30  demo_user.doofus.local    llI am not married to seeing the DNS name. I would only want it there if it pulls it from who or another location without the need to perform a lookup or query of any kind. I would be happy with IP address.002  03/26/12 05:11:30  192.168.0.2    llWhy? I manage several systems where a userid that several users of the same group share to do their daily tasks. This would allow me to correlate their real location & actual user within the organization to what they did in in the history.I am aware that this is not optimal and would like to change it but, when you are on a ship the size of the a cruise liner you don't attempt to make hairpin turns. (Note: when you do the passengers try to toss you overboard)Anyway, until I am able to migrate them to a better solution I would like to have this tracking ability.Also, if you have any recommendations over what I am currently using for my history modifications I would love to hear it.Thanks,Edit: 1I do not want to run other programs or have to configure anything additional within reason. I want to add 0 overhead, if I do have to add it needs to be small. I do trust my users I just would like (should something happen) to see which of the say 10 users that logged into the system with the same user:password did it. Or, it might not have been a user it could have been a forgotten cron on a system that performs a connection as a user to do something. Or an application Ex: BMC Control-M that connects over ssh and runs tasks. It is not so much about finding bad users as being able to track it down with a minimum of effort.Edit 2:The systems are running SLES and RHEL
How do I add network or user source connection data to history entries?
shell;users;command history;audit