You can add `-DSYSLOG_HISTORY` to your CFLAGS for building. And for formatting, apply this patch: --- bashhist.c 2015-08-11 00:09:38.449468800 +0800 +++ bashhist.c 2015-08-11 00:09:42.970623400 +0800 @@ -713,12 +713,12 @@ char trunc[SYSLOG_MAXLEN];
if (strlen(line) < SYSLOG_MAXLEN) - syslog (SYSLOG_FACILITY|SYSLOG_LEVEL, "HISTORY: PID=%d UID=%d %s", getpid(), current_user.uid, line); + syslog (SYSLOG_FACILITY|SYSLOG_LEVEL, "bash[%d]: UID=%d %s", getpid(), current_user.uid, line); else { strncpy (trunc, line, SYSLOG_MAXLEN); trunc[SYSLOG_MAXLEN - 1] = '\0'; - syslog (SYSLOG_FACILITY|SYSLOG_LEVEL, "HISTORY (TRUNCATED): PID=%d UID=%d %s", getpid(), current_user.uid, trunc); + syslog (SYSLOG_FACILITY|SYSLOG_LEVEL, "bash[%d] (TRUNCATED): UID=%d %s", getpid(), current_user.uid, trunc); } } #endif I'm not quite familiar with those configure.ac magic, and therefore I can't write some AC_ARG_ENABLE for you.