Adding timestamp and user to bash history - bash

Question

I want to add the timestamp and user, who executed the command to my history command. Is this even possible?
By adding this line to the ~/.bashrc, you're able to add the timestamps to the history command:
HISTTIMEFORMAT="[ %Y/%m/%d %T ] "
This results in something like this by running history:
1841 [ 2016/08/25 10:57:54 ] ls
1842 [ 2016/08/25 10:57:56 ] who
1843 [ 2016/08/25 10:57:59 ] last
1844 [ 2016/08/25 10:58:10 ] uptime
1845 [ 2016/08/25 10:58:13 ] history
Now, I want an additional info: Which real user has executed these commands?
Yes, the history is saved and written for each individual user to the $HISTFILE (~/.bash_history), but usually has every user his own login like "firstname-name" or anything else.
An example user called "max-mustermann" logs in via SSH and switches to the user "root" for example. The user "max-mustermann" is now acting as "root".
I want to log the "real" user (in this case "max-mustermann") and maybe some additional information like the used IP address, to be able to identify, who has executed the command "uptime" as user "root". I thought, I've found a solution, but it didn't really work. Add the following lines to your ~/.bashrc to test it:
TTY_CON=$(tty | cut -d '/' -f 3-);
HIST_WHO_INFO=$(who | grep "${TTY_CON}" | cut -d ' ' -f 1,12);
HISTTIMEFORMAT="[ %Y/%m/%d %T by ${HIST_WHO_INFO} ] "
This returns something like this:
1848 [ 2016/08/25 11:06:47 by max-mustermann (10.50.1.42:S.0) ] ls
1849 [ 2016/08/25 11:06:48 by max-mustermann (10.50.1.42:S.0) ] who
1850 [ 2016/08/25 11:06:49 by max-mustermann (10.50.1.42:S.0) ] last
1851 [ 2016/08/25 11:06:51 by max-mustermann (10.50.1.42:S.0) ] uptime
1852 [ 2016/08/25 11:06:52 by max-mustermann (10.50.1.42:S.0) ] history
That's perfect, but unfortunately, it doesn't keep / save the real user with the history. If somebody else logs in, all commands, which were executed as user "max-mustermann" in this example would get updated to the new user, who has logged in:
1848 [ 2016/08/25 11:06:47 by somebody-else (10.50.1.18) ] ls
1849 [ 2016/08/25 11:06:48 by somebody-else (10.50.1.18) ] who
1850 [ 2016/08/25 11:06:49 by somebody-else (10.50.1.18) ] last
1851 [ 2016/08/25 11:06:51 by somebody-else (10.50.1.18) ] uptime
1852 [ 2016/08/25 11:06:52 by somebody-else (10.50.1.18) ] history
1853 [ 2016/08/25 11:08:13 by somebody-else (10.50.1.18) ] history
How can I solve this problem?

Answer 1

This is not always possible, depending on your server configuration and user behaviour, but can be if you "educate" your users properly. There are 2 ways (that I know of) you can get this information.
Just let your users only use sudo whenever they actually need it. Don't "switch" to root and start running commands. Just run seperate commands with a sudo prefix whenever you actually need root access. That way the history is still saved per user (and a sudo log will be written to the /var/log/auth.log file on most systems).
Make them switch to root using sudo su and not sudo su -, the - will reset their environment variables. But if you omit that -, the root enviroment variables should have a SUDO_USER variable holding the user that switched to the account. For example:
oldskool#server:~$ sudo su
root#server:/home/oldskool# echo $SUDO_USER
oldskool
You could use that SUDO_USER in your history timeformat.

Answer 2

HISTTIMEFORMAT will only save epoch to HISTFILE. You can't add any other text. Instead, I create different files per user:
echo "export HISTSIZE=10000" >> ~/.bash_profile
echo "export HISTTIMEFORMAT=\"%F %T \"" >> ~/.bash_profile
echo "export HISTFILE=\"/root/.bash_history_\$(who am i | awk '{print $1}')\"" >> ~/.bash_profile
echo "export PROMPT_COMMAND='history -a'" >> ~/.bash_profile