OS X Terminal: Log All Commands into the system.log

Pasting the follow code into ~/.bash_profile  will append any commands entered into the syslog with the tag BASHFU.

PROMPT_COMMAND='history -a;tail -n1 ~/.sh_history | logger -t BASHFU'

This is a fun trick that I use with my Single-user Mode Intrusion Detection System.  Some other uses I would like to try this for is to log only sudo  commands by all users.

Leave a Reply