Дописываем в /etc/profile
whoami="$(whoami)@$(echo $SSH_CONNECTION | awk '{print $1}')" export PROMPT_COMMAND='RETRN_VAL=$?;logger -p local3.debug "$whoami [$$]: $(history 1 | sed "s/^[ ]*[0-9]\+[ ]*//" ) [$RETRN_VAL]"'
дописываем в syslogd.conf
local3.* -/var/log/prompt.log