popexizhi: sysdig &spy

#spy_users 获得当前活动用户的命令交换，以下是root和test用户的测试记录

sysdig -c spy_users

31037 20:25:38 root) /usr/bin/id -un

31037 20:25:38 root) /usr/bin/hostname

31037 20:25:38 root) ls /etc/bash_completion.d

31037 20:25:38 root) uname -o

31037 20:25:38 root) pidof glusterd

31037 20:25:38 root) pkg-config --variable=completionsdir bash-completion

31037 20:25:38 root) /bin/sh /usr/libexec/grepconf.sh -c

31037 20:25:38 root) grep -qsi ^COLOR.*none /etc/GREP_COLORS

31037 20:25:38 root) /usr/bin/tty -s

31037 20:25:38 root) /usr/bin/tput colors

31037 20:25:38 root) /usr/bin/dircolors --sh /etc/DIR_COLORS

31037 20:25:38 root) /usr/bin/grep -qi ^COLOR.*none /etc/DIR_COLORS

31037 20:25:38 root) /sbin/consoletype stdout

31037 20:25:38 root) uname -m

31037 20:25:38 root) /bin/grep -q /usr/lib64/qt-3.3/bin

31037 20:25:38 root) /usr/bin/id -u

31037 20:25:55 root) ls --color=auto

31037 20:26:03 root) cd /root/test

31037 20:26:06 root) who

31037 20:26:23 root) who

31037 20:26:28 root) whoami

31037 20:26:46 root) su test

31037 20:26:47 test) bash

31037 20:26:47 test) /usr/bin/id -gn

31037 20:26:47 test) /usr/bin/id -un

31037 20:26:47 test) ls /etc/bash_completion.d

31037 20:26:47 test) uname -o

31037 20:26:47 test) pidof glusterd

31037 20:26:47 test) pkg-config --variable=completionsdir bash-completion

31037 20:26:47 test) /bin/sh /usr/libexec/grepconf.sh -c

31037 20:26:47 test) grep -qsi ^COLOR.*none /etc/GREP_COLORS

31037 20:26:47 test) /usr/bin/tty -s

31037 20:26:47 test) /usr/bin/tput colors

31037 20:26:47 test) /usr/bin/dircolors --sh /etc/DIR_COLORS

31037 20:26:47 test) /usr/bin/grep -qi ^COLOR.*none /etc/DIR_COLORS

31037 20:26:47 test) /usr/bin/id -u

31037 20:26:52 test) ls --color=auto

popexizhi