# 创建超级简单的监控系统
cat > /usr/local/bin/watchcmd << 'EOF'
#!/bin/bash

LOG="/root/watch.log"
PID="/tmp/watch.pid"

case "$1" in
    start)
        # 停止其他监控
        pkill -f "cmdwatch"
        pkill -f "monitor"
        pkill -f "mt"
        pkill -f "mon"
        
        # 设置实时history
        echo 'export PROMPT_COMMAND="history -a; history -c; history -r"' >> ~/.bashrc
        source ~/.bashrc
        
        # 启动监控
        (
            echo "监控启动: $(date)" > "$LOG"
            declare -A sizes
            
            while true; do
                for user in /home/* /root; do
                    [ -d "$user" ] || continue
                    history_file="$user/.bash_history"
                    [ -f "$history_file" ] || continue
                    
                    user_name=$(basename "$user")
                    current=$(stat -c%s "$history_file" 2>/dev/null || echo 0)
                    last=${sizes["$user_name"]:-0}
                    
                    if [ "$current" -gt "$last" ]; then
                        cmd=$(tail -n 1 "$history_file" 2>/dev/null | tr -d '\000-\037')
                        if [ -n "$cmd" ] && [ ${#cmd} -gt 1 ]; then
                            case "$cmd" in
                                ls|cd|pwd|ll|history|exit|clear|watchcmd|".") 
                                    continue 
                                    ;;
                                *)
                                    ip="unknown"
                                    [ -n "$SSH_CLIENT" ] && ip=$(echo "$SSH_CLIENT" | awk '{print $1}')
                                    echo "[$(date '+%Y-%m-%d %H:%M:%S')] $user_name: $cmd (from: $ip)" >> "$LOG"
                                    sizes["$user_name"]=$current
                                    ;;
                            esac
                        fi
                    fi
                done
                sleep 1
            done
        ) &
        echo $! > "$PID"
        echo "监控已启动"
        ;;
    stop)
        pkill -f "watchcmd"
        rm -f "$PID"
        echo "监控已停止"
        ;;
    view)
        if [ -f "$LOG" ]; then
            tail -f "$LOG"
        else
            echo "暂无日志"
        fi
        ;;
    status)
        if [ -f "$PID" ] && ps -p $(cat "$PID") >/dev/null 2>&1; then
            echo "监控运行中 (PID: $(cat "$PID"))"
        else
            echo "监控未运行"
            rm -f "$PID"
        fi
        ;;
    install)
        # 设置开机启动
        (crontab -l 2>/dev/null; echo "@reboot /usr/local/bin/watchcmd start >/dev/null 2>&1") | crontab -
        # 设置别名
        echo "alias wc='watchcmd view'" >> ~/.bashrc
        source ~/.bashrc
        # 启动
        watchcmd start
        echo "安装完成! 使用 'wc' 查看监控"
        ;;
    *)
        echo "使用: watchcmd [start|stop|view|status|install]"
        ;;
esac
EOF

chmod +x /usr/local/bin/watchcmd

# 安装并测试
watchcmd install

# 测试
wc