collectroothistory.sh

#!/bin/bash
## Collect Root Commands History

# Mailing List
MAILLIST="YOUREMAIL@DOMAIN"

# Log path
AUDLOG="/rootcommands"

cp /root/.bash_history /tmp/history
sed -i 's/#//g' /tmp/history
for i in `cat /tmp/history |grep ^[0-9]`
do
CONVT=`date -d @$i`
sed -i "s/$i/$CONVT/g" /tmp/history
done

sed -i 'N;s/\n/ /' /tmp/history
sleep 10

/bin/touch ${AUDLOG}$HOSTNAME-root-hist.log.`date +%h%d%y`
/bin/grep "$DATE" /tmp/history > ${AUDLOG}$HOSTNAME-root-hist.log.`date +%h%d%y`
/bin/chmod 0440 ${AUDLOG}$HOSTNAME-root-hist.log.`date +%h%d%y`

# Mail notification
/bin/cat ${AUDLOG}$HOSTNAME-root-hist.log.`date +%h%d%y` |mail -s "HOST: $HOSTNAME - `whoami` Daily root Commands Log" ${MAILLIST}