bashhist.c.patch. originally for bash 4.1, this change updates the log entries sent to syslog to match the format of the BOFH hardened TCSH shell. consistent log formats makes it easier to detect anomolies. goes with the blog post at http://www.timkennedy.net/2010/12/logging-shell-commands-to-syslog-on.html

gistfile1.diff

--- bashhist.c.orig     2010-12-07 04:16:12.692508765 -0500
+++ bashhist.c  2010-12-07 04:43:19.635794444 -0500
@@ -709,12 +709,12 @@
   char trunc[SYSLOG_MAXLEN];

   if (strlen(line) < SYSLOG_MAXLEN)
-    syslog (SYSLOG_FACILITY|SYSLOG_LEVEL, "HISTORY: PID=%d UID=%d %s", getpid(), current_user.uid, line);
+    syslog (SYSLOG_FACILITY|SYSLOG_LEVEL, "HISTORY: [%s UID=%d] %s", current_user.user_name, current_user.uid, line);
   else
     {
       strncpy (trunc, line, SYSLOG_MAXLEN);
       trunc[SYSLOG_MAXLEN - 1] = '\0';
-      syslog (SYSLOG_FACILITY|SYSLOG_LEVEL, "HISTORY (TRUNCATED): PID=%d UID=%d %s", getpid(), current_user.uid, trunc);
+      syslog (SYSLOG_FACILITY|SYSLOG_LEVEL, "HISTORY (TRUNCATED): [%s UID=%d] %s", current_user.user_name, current_user.uid, trunc);
      }
 }
 #endif