Bash History Issue

[tkoster8]

I recently pushed the Splunk_TA_nix App. In it it has a line to pull Bash history. However I'm noticing that everytime a user logs in it pulls in their whole bash history file whenever changes are made. So person A logs in 3 times in a day... there are three full histories of stuff they did weeks ago in splunk time stamped for today.

I'm trying to figure out how to stop this duplication from happening. Fschange seems like it might work but it sounds like it is depreciated so would prefer something that isn't going to randomly drop.

This is what the app has in the stanzas:

### bash history
[monitor:///root/.bash_history]
disabled = 0
sourcetype = bash_history
index = os

[monitor:///home/.../.bash_history]
disabled = 0
sourcetype = bash_history
index = os

I did try adding in the temporary followTail but to no avail.

[jplumsdaine22]

That is odd - the initCrc should not be changing (unless theres a timestamp at the top of the file or something) so it should not be re-indexing the whole file.

Do you have some customisation around how bash histories are written in your environment?

That said, if you're serious about monitoring commands you should look at auditd instead. There is no good way to do time attribution on a bash_history file, as all session history is written on log out.

[sloshburch]

Yea. That doesn't sound right. I won't if there are other config at play here. Like maybe a default stanza that has changed the initCrc for all inputs...