Collects command histories from bash, zsh, and ksh93 Linux shells.
Supported Platforms
Linux and macOS only
Input Parameters
The following input parameters are available for this audit.
UserList
Details | Values | Description |
|---|---|---|
Platform | Linux | Linux environments |
Format | ArrayOfString | Valid values are specified in an array of string values. |
Required? | no | This parameter is not required. |
Repeatable? | no | This parameter can be specified only once per audit request. It cannot be repeated. |
Valid Values | Specify the list of users whose histories the audit should collect. If this parameter is not specified, the histories for all users are collected. |
ShellList
Details | Values | Description |
|---|---|---|
Platform | Linux | Linux environments |
Format | ArrayOfString | Valid values are specified in an array of string values. |
Required? | no | This parameter is not required. |
Repeatable? | no | This parameter can be specified only once per audit request. It cannot be repeated. |
Valid Values | Specify the list of shells to which the audit should limit its collection. |
CommandRegex
Details | Values | Description |
|---|---|---|
Platform | Linux | Linux environments |
Format | ArrayOfString | Valid values are specified in an array of string values. |
Required? | no | This parameter is not required. |
Repeatable? | no | This parameter can be specified only once per audit request. It cannot be repeated. |
Valid Values | Specify a list of Perl-compatible regular expressions. The audit will collect only commands that match the supplied regex list. |
IncludeBefore
Details | Values | Description |
|---|---|---|
Platform | Linux | Linux environments |
Format | dateTime | Valid values are a timestamp. |
Required? | no | This parameter is not required. |
Repeatable? | no | This parameter can be specified only once per audit request. It cannot be repeated. |
Valid Values | Specify a timestamp. The audit will collect only commands executed before the supplied timestamp. Commands that do not have an associated timestamp are included in the output. |
IncludeAfter
Details | Values | Description |
|---|---|---|
Platform | Linux | Linux environments |
Format | dateTime | Valid values are a timestamp. |
Required? | no | This parameter is not required. |
Repeatable? | no | This parameter can be specified only once per audit request. It cannot be repeated. |
Valid Values | Specify a timestamp. The audit will collect only commands executed after the supplied timestamp. Commands that do not have an associated timestamp are included in the output. |