How come no one ever told me about this!  A while ago we were tasked to find a way to log all commands executed by root.  I know bash_history is easily manipulated so I spent some time on google trying to find a logging shell, then got distracted by something shiny and forgot all about this task.  Turns out the linux auditing system has a built-in tty logging accounting module that will log all tty sessions!  Just add this to your pam stack (/etc/pam.d/system-auth on redhat and clones):

session required pam_tty_audit.so disable=* enable=root

Then run a few commands as root, and the aureport command will become your friend:

audit]# aureport --tty -ts today

TTY Report
===============================================
# date time event auid term sess comm data
===============================================
1. 11/22/2009 00:07:52 132278 1040 ? 4294962295 bash "hello world",<ret>

UPDATE:

You need a newer version of the audit rpm package, tty info will be collected but aureport does not know how to display them.

https://bugzilla.redhat.com/show_bug.cgi?id=497518

To start a new screen session just type “screen”. You will see a welcome screen, just start typing away as if you are in a regular terminal session. Need a new window? “CTRL-A c” will create one. “CTRL-A p” goes to your previous screen, “CTRL-A n” goes to your next screen.  When you get to the last screen it just goest back to the first one.

So now you are ready to detach, “CTRL-d” detaches.  When you want to reconnect, I usually do a “screen -dr”, the d will detach the screen session if I had forgotten to before exiting then connect.

One feature I use a lot, especially when working with network gear, is the screenloging.  I connect to my router, type “CTRL-A H” to create a logfile, anything on the screen after that will get logged to the screenlog file.  Then if I do a “show run” my router config is saved incase I mess things up.

One final usage of screen that I empoy is as a serial interface, I connect my routers via serial to my linux laptop, then fire up screen like this “screen 9600 /dev/ttyS0″ and voila.  Buy a bunch of usb serial dongles and build your own Serial Console server this way.  Turn on screenlogging and you can capture router error messages ghetto style.

Way to go, I had to set the clock back to last week on my ESXi console. There goes my VMWare consolidation proposal at work.

I wouldn’t want to be the poor developer that forgot to take out the “if date = august 12 2008 then fail” line of code.

It is not installed by default in debian, so the following will install the app.


user@slashzero-desktop:~$ sudo aptitude install pv


Once installed, passing the “–help” parameter will list the basic options.


user@slashzero-desktop:~$ pv --help
Usage: pv [OPTION] [FILE]...
Concatenate FILE(s), or standard input, to standard output,
with monitoring.
-p, --progress show progress bar
-t, --timer show elapsed time
-e, --eta show estimated time of arrival (completion)
-r, --rate show data transfer rate counter
-b, --bytes show number of bytes transferred
-f, --force output even if standard error is not a terminal
-n, --numeric output percentages, not visual information
-q, --quiet do not output any transfer information at all
-c, --cursor use cursor positioning escape sequences
-W, --wait display nothing until first byte transferred
-s, --size SIZE set estimated data size to SIZE bytes
-l, --line-mode count lines instead of bytes
-i, --interval SEC update every SEC seconds
-w, --width WIDTH assume terminal is WIDTH characters wide
-H, --height HEIGHT assume terminal is HEIGHT rows high
-N, --name NAME prefix visual information with NAME
-L, --rate-limit RATE limit transfer to RATE bytes per second
-B, --buffer-size BYTES use a buffer size of BYTES
-R, --remote PID update settings of process PID
-h, --help show this help and exit
-V, --version show version information and exit
Please report any bugs to Andrew Wood .


And here is a quick example, this command tar’s up a directory and send the output to gzip, showing a rate of 223MB/s:


user@slashzero-desktop:/home$ tar zcf - user | pv /bin/gzip > /tmp/backup.tar.gz
59.7kB 0:00:00 [ 223MB/s] [===========================================>] 100%


Incredibly useful stuff.

serverB:/ scp user@serverA:/file user@serverC:/file

Actually works.  I love linux. It’s awesome