3344/dock
1
0
Fork 0
Code Issues Packages Projects Releases 1 Wiki Activity

Update 实时 history 监控

Browse Source
This commit is contained in:
xzx3344521
2025-10-22 09:38:52 +08:00
committed by GitHub
parent d7ec942ca2
commit 2327afde19
1 changed files with 30 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files

70
实时 history 监控
View File

@@ -1,83 +1,73 @@
# 创建最简单的监控脚本 # 创建最简单的监控系统
cat > /usr/local/bin/monitor << 'EOF' cat > /usr/local/bin/mt << 'EOF'
#!/bin/bash #!/bin/bash
LOG_FILE="/root/command_logs/monitor.log" LOG="/root/command_logs/monitor.log"
PID_FILE="/tmp/monitor.pid" PID="/tmp/monitor.pid"
case "$1" in case "$1" in
start) start)
# 设置实时history
echo 'export PROMPT_COMMAND="history -a; history -c; history -r"' >> ~/.bashrc echo 'export PROMPT_COMMAND="history -a; history -c; history -r"' >> ~/.bashrc
source ~/.bashrc source ~/.bashrc
# 启动监控进程
( (
mkdir -p /root/command_logs mkdir -p /root/command_logs
declare -A sizes declare -A size
for u in /home/* /root; do
[ -d "$u" ] && h="$u/.bash_history" && [ -f "$h" ] && size["$(basename "$u")"]=$(stat -c%s "$h" 2>/dev/null || echo 0)
done
while true; do while true; do
for user_dir in /home/* /root; do for u in /home/* /root; do
[ -d "$user_dir" ] || continue [ -d "$u" ] || continue
user=$(basename "$user_dir") user=$(basename "$u")
history_file="$user_dir/.bash_history" hfile="$u/.bash_history"
[ -f "$history_file" ] || continue [ -f "$hfile" ] || continue
current=$(stat -c%s "$history_file" 2>/dev/null || echo 0) cur=$(stat -c%s "$hfile" 2>/dev/null || echo 0)
last=${sizes["$user"]:-0} last=${size["$user"]:-0}
if [ "$current" -gt "$last" ]; then if [ "$cur" -gt "$last" ]; then
cmd=$(tail -n 1 "$history_file" 2>/dev/null) cmd=$(tail -n 1 "$hfile" 2>/dev/null)
if [ -n "$cmd" ] && [ ${#cmd} -gt 1 ]; then if [ -n "$cmd" ] && [ ${#cmd} -gt 1 ]; then
case "$cmd" in case "$cmd" in
ls|cd|pwd|ll|history|exit|clear|"."|"..") continue ;; ls|cd|pwd|ll|history|exit|clear|mt|".") continue ;;
*) *)
ip="unknown" ip="unknown"
[ -n "$SSH_CLIENT" ] && ip=$(echo "$SSH_CLIENT" | awk '{print $1}') [ -n "$SSH_CLIENT" ] && ip=$(echo "$SSH_CLIENT" | awk '{print $1}')
echo "[$(date '+%Y-%m-%d %H:%M:%S')] 用户:$user | 命令:$cmd | 来源:$ip" >> "$LOG_FILE" echo "[$(date '+%Y-%m-%d %H:%M:%S')] $user: $cmd (from: $ip)" >> "$LOG"
;; ;;
esac esac
fi fi
sizes["$user"]=$current size["$user"]=$cur
fi fi
done done
sleep 2 sleep 2
done done
) & ) &
echo $! > "$PID_FILE" echo $! > "$PID"
echo "监控已启动" echo "监控已启动"
;; ;;
stop) stop)
[ -f "$PID_FILE" ] && kill $(cat "$PID_FILE") 2>/dev/null [ -f "$PID" ] && kill $(cat "$PID") 2>/dev/null
rm -f "$PID_FILE" rm -f "$PID"
echo "监控已停止" echo "监控已停止"
;; ;;
view) view)
if [ -f "$LOG_FILE" ]; then [ -f "$LOG" ] && tail -f "$LOG" || echo "无日志"
tail -f "$LOG_FILE"
else
echo "暂无日志"
fi
;; ;;
*) *)
echo "使用方法:" echo "用法: mt [start|stop|view]"
echo " monitor start # 启动监控"
echo " monitor stop # 停止监控"
echo " monitor view # 查看日志"
;; ;;
esac esac
EOF EOF
chmod +x /usr/local/bin/monitor chmod +x /usr/local/bin/mt
# 设置开机启动 # 设置开机启动
(crontab -l 2>/dev/null; echo "@reboot /usr/local/bin/monitor start >/dev/null 2>&1") | crontab - (crontab -l 2>/dev/null; echo "@reboot /usr/local/bin/mt start >/dev/null 2>&1") | crontab -
# 启动监控 # 启动
monitor start mt start
echo "简化版安装完成!" echo "安装完成! 使用 'mt view' 查看日志"
echo "使用: monitor view 查看实时日志"