#!/bin/bash # 监控用户命令 cat >> ~/.bashrc << 'EOB' # ============= 监控用户命令 ============= # preexec 函数,在命令执行前调用 preexec() { local command="$BASH_COMMAND" # 忽略内部命令 if [[ "$command" == "precmd" || "$command" == "preexec_invoke_exec" ]]; then return fi local timestamp=$(date "+%Y-%m-%d %H:%M:%S") local user=$(whoami) local cwd=$(pwd) echo "$timestamp - $user - $cwd - START: $command" >> /tmp/users-command.log } # precmd 函数,在命令执行后调用 precmd() { local exit_code=$? local last_command=$(HISTTIMEFORMAT= history 1 | sed 's/^ *[0-9]\+ *//') local timestamp=$(date "+%Y-%m-%d %H:%M:%S") local user=$(whoami) local cwd=$(pwd) echo "$timestamp - $user - $cwd - END: $last_command [exit code: $exit_code]" >> /tmp/users-command.log } # 设置 preexec 功能 preexec_invoke_exec() { [ -n "$COMP_LINE" ] && return # 如果是补全命令,则不执行 preexec "$(history 1 | sed 's/^ *[0-9]\+ *//')" } trap 'preexec_invoke_exec' DEBUG # 设置 precmd 功能 PROMPT_COMMAND="precmd; $PROMPT_COMMAND" # ============= 监控用户命令 ============= EOB echo "安装完成: source ~/.bashrc ,请查看:/tmp/users-command.log"