Skip to content

Instantly share code, notes, and snippets.

Last active December 28, 2015 08:18
What would you like to do?
bashhist.c.patch. originally for bash 4.1, this change updates the log entries sent to syslog to match the format of the BOFH hardened TCSH shell. consistent log formats makes it easier to detect anomolies. goes with the blog post at
--- bashhist.c.orig 2010-12-07 04:16:12.692508765 -0500
+++ bashhist.c 2010-12-07 04:43:19.635794444 -0500
@@ -709,12 +709,12 @@
char trunc[SYSLOG_MAXLEN];
if (strlen(line) < SYSLOG_MAXLEN)
- syslog (SYSLOG_FACILITY|SYSLOG_LEVEL, "HISTORY: PID=%d UID=%d %s", getpid(), current_user.uid, line);
+ syslog (SYSLOG_FACILITY|SYSLOG_LEVEL, "HISTORY: [%s UID=%d] %s", current_user.user_name, current_user.uid, line);
strncpy (trunc, line, SYSLOG_MAXLEN);
trunc[SYSLOG_MAXLEN - 1] = '\0';
- syslog (SYSLOG_FACILITY|SYSLOG_LEVEL, "HISTORY (TRUNCATED): PID=%d UID=%d %s", getpid(), current_user.uid, trunc);
+ syslog (SYSLOG_FACILITY|SYSLOG_LEVEL, "HISTORY (TRUNCATED): [%s UID=%d] %s", current_user.user_name, current_user.uid, trunc);
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment