0

I searched the AskUbuntu database but the closest thing I found was a question on how to log errors.

What I'm looking for is to append to a log file / audit trail every time sudo gedit / gksu gedit / pkexec gedit is used. In reality I'll be using a wrapper script called gsu that calls pkexec gedit.

What I would like to do is append to a audit file say ~/gedit-log the following:

YYYY-MM-DD hh:mm:ss Count /SystemDirectoryName/SystemFileName

Keep in mind I may navigate to /SystemDirectoryName and then call gsu gedit SystemFileName so the the first parameter can't be automatically used because the path must be prepended. Therefore a bash command "here is the file name, give me the full path and file name" is required.

The current date and time should be in human readable format (not the number of seconds from 1970 (epoch time)). The Date and Time mask in the example is probably inappropriate and should conform to industry standards instead.

A command is needed to append the combination string + CR/LF (Carriage Return Line Feed) to the audit trail / log file.

Down the road a massaging program / script would be needed to tally up all the times a given file has been edited (/etc/default/grub could get a lot of edits) into the "count" field and delete the extraneous records. This would probably be a cron daily job?

It might make sense to have two date/time fields. One for first time changed and one for last time changed.

Hopefully this code already exists in the Linuxverse or something close to it can be easily adapted.

The code itself might be put into a separate bash script so it can be re-purposed for many situations... ie this user edited that payroll file, etc.

  • I'm confused. pkexec and sudo do log calls, I don't know what gksu does, but if you're actually using pkexec, the logging is already done. So why not just use journalctl for this? – muru Nov 17 '16 at 1:32
  • If Journalctl will track a group of files and only that group of files for years it will be perfect. I honestly didn't know it did that. – WinEunuuchs2Unix Nov 17 '16 at 1:34
  • It's not tracking anything, pkexec and sudo are tracking calls to themselves and journald is saving that, and whether it does that for years depends on whether you're saving journald files for years. journalctl is just the means to access that log. – muru Nov 17 '16 at 1:42
  • Is there an answer... ie "Journalctl pkexec gedit" shows you all the files you've edited? – WinEunuuchs2Unix Nov 17 '16 at 1:44
  • journalctl /usr/bin/pkexec will show uses of pkexec. The COMMAND part will then contain the command executed, gedit or not. – muru Nov 17 '16 at 1:46
0

The simplest answer for me to wrap my head around is not using journalctl derivatives but rather "brute force" programming / scripting.

Here is the code.

~/bin/gsu:

#!/bin/bash

# Usage: gsu gedit file1 file2...
#  -OR-  gsu natuilus /dirname

# & is used to spawn process and get prompt back ASAP
# > /dev/null is used to send gtk warnings into dumpster

COMMAND="$1" # extract gedit or nautilus

pkexec "$COMMAND" "${@:2}"

log-file "${@:2}" gsu-log-file-for-"$COMMAND"

/usr/local/bin/log-file:

#! /bin/bash

# NAME: log-file
# PATH: /usr/local/bin
# DESC: Update audit trail/log file with passed parameters.
# CALL: log-file FileName LogFileName
# DATE: Created Nov 18, 2016.
# NOTE: Primarily called from ~/bin/gsu

ABSOLUTE_NAME=$(realpath "$1")
TIME_STAMP=$(date +"%D - %T")
LOG_FILE="$2"

# Does log file need to be created?
if [ ! -f "$LOG_FILE" ]; then
    touch "$LOG_FILE"
    echo "__Date__ - __Time__ - ______File Name______" >> "$LOG_FILE"
    #     MM/DD/YY - hh:mm:ss - "a/b/c/FileName"
fi

echo "$TIME_STAMP" - '"'"$ABSOLUTE_NAME"'"' >> "$LOG_FILE"

exit 0

Contents of log file gsu-log-file-for-geditafter a few edits:

__Date__ - __Time__ - ______File Name______
11/18/16 - 19:07:54 - "/etc/default/grub"
11/18/16 - 19:08:34 - "/home/rick/bin/gsu"
11/18/16 - 19:09:26 - "/home/rick/bin/gsu"

Future enhancements

A consolidation script which will take take last two lines and merge them into:

11/18/16 - 19:09:26 - "/home/rick/bin/gsu" (2 edits, first on 11/18/16 - 19:08:34"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.