Did You Know?
Ask a Question

We are pleased to announce the Launch of our New Section "TecMint Ask"

The Power of Linux “History Command” in Bash Shell

Download Your Free eBooks NOW - 10 Free Linux eBooks for Administrators

We use history command frequently in our daily routine jobs to check history of command or to get info about command executed by user. In this post, we will see how we can use history command effectively to extract the command which was executed by users in Bash shell. This may be useful for audit purpose or to find out what command is executed at what date and time.

By default date and timestamp won’t be seen while executing history command. However, bash shell provides CLI tools for editing user’s command history. Let’s see some handy tips and tricks and power of history command.

linux history command

history command examples

1. List Last/All Executed Commands in Linux

Executing simple history command from terminal will show you a complete list of last executed commands with line numbers.

[narad@tecmint ~]$ history

    1  PS1='\e[1;35m[\u@\h \w]\$ \e[m '
    2  PS1="\e[0;32m[\u@\h \W]\$ \e[m "
    3  PS1="\u@\h:\w [\j]\$ "
    4  ping google.com
    5  echo $PS1
    6   tail -f /var/log/messages
    7  tail -f /var/log/messages
    8  exit
    9  clear
   10  history
   11  clear
   12  history

2. List All Commands with Date and Timestamp

How to find date and timestamp against command? With ‘export’ command with variable will display history command with corresponding timestamp when the command was executed.

[narad@tecmint ~]$ export HISTTIMEFORMAT='%F %T  '

      1  2013-06-09 10:40:12   cat /etc/issue
      2  2013-06-09 10:40:12   clear
      3  2013-06-09 10:40:12   find /etc -name *.conf
      4  2013-06-09 10:40:12   clear
      5  2013-06-09 10:40:12   history
      6  2013-06-09 10:40:12   PS1='\e[1;35m[\u@\h \w]\$ \e[m '
      7  2013-06-09 10:40:12   PS1="\e[0;32m[\u@\h \W]\$ \e[m "
      8  2013-06-09 10:40:12   PS1="\u@\h:\w [\j]\$ "
      9  2013-06-09 10:40:12   ping google.com
     10  2013-06-09 10:40:12   echo $PS1
Meaning of HISTTIMEFORMAT variables
%F Equivalent to %Y - %m - %d
%T Replaced by the time ( %H : %M : %S )

3. Filter Commands in History

As we can see same command is being repeated number of times in above output. How to filter simple or non destructive commands in history?. Use the following ‘export‘ command by specifying command in HISTIGNORE=’ls -l:pwd:date:’ will not saved by system and not be shown in history command.

[narad@tecmint ~]$ export HISTIGNORE='ls -l:pwd:date:'

4. Ignore Duplicate Commands in History

With the below command will help us to ignore duplicate commands entry made by user. Only single entry will be shown in history, if a user execute a same command multiple times in a Bash Prompt.

[narad@tecmint ~]$ export HISTCONTROL=ignoredups

5. Unset export Command

Unset export command on the fly. Execute unset export command with variable one by one whatever commands have been exported by export command.

[narad@tecmint ~]$ unset export HISTCONTROL

6. Save export Command Permanently

Make an entry as follows in .bash_profile to save export command permanently.

[narad@tecmint ~]$ vi .bash_profile

# .bash_profile

# Get the aliases and functions
if [ -f ~/.bashrc ]; then
        . ~/.bashrc
fi

# User specific environment and startup programs

export HISTCONTROL=ignoredups

PATH=$PATH:$HOME/bin
export PATH

7. List Specific User’s Executed Commands

How to see command history executed by a specific user. Bash keeps records of history in a ‘~/.bash_history’ file. We can view or open file to see the command history.

[narad@tecmint ~]$ vi .bash_history

cd /tmp/
cd logstalgia-1.0.3/
./configure
sudo passwd root
apt-get install libsdl1.2-dev libsdl-image1.2-dev libpcre3-dev libftgl-dev libpng12-dev libjpeg62-dev make gcc
./configure
make
apt-get install libsdl1.2-dev libsdl-image1.2-dev libpcre3-dev libftgl-dev libpng12-dev libjpeg62-dev make gcc++
apt-get install libsdl1.2-dev libsdl-image1.2-dev libpcre3-dev libftgl-dev libpng12-dev libjpeg62-dev make gcc
apt-get install make
mysql -u root -p
apt-get install grsync
apt-get install unison
unison

8. Disable Storing History of Commands

Some organization do not keep history of commands because of security policy of the organization. In this case, we can edit .bash_profile file (It’s hidden file) of user’s and make an entry as below.

[narad@tecmint ~]$ vi .bash_profile

# .bash_profile

# Get the aliases and functions
if [ -f ~/.bashrc ]; then
        . ~/.bashrc
fi

# User specific environment and startup programs

PATH=$PATH:$HOME/bin
HISTSIZE=0
export PATH
.bash_profile (END)

Save file and load changes with below command.

[narad@tecmint ~]$ source .bash_profile

Note: If you don’t want system to remember the commands that you have typed, simply execute below command which will disable or stop recording history on the fly.

[narad@tecmint ~]$ export HISTSIZE=0

Tips: Search ‘HISTSIZE‘ and edit in ‘/etc/profile’ file with superuser. The change in file will effect globally.

9. Delete or Clear History of Commands

With up and down arrow, we can see previously used command which may be helpful or may irate you. Deleting or clearing all the entries from bash history list with ‘-c‘ options.

[narad@tecmint ~]$ history -c

10. Search Commands in History Using Grep Command

Search command through ‘.bash_history‘ by piping your history file into ‘grep‘ as below. For example, the below command will search and find ‘pwd‘ command from the history list.

[narad@tecmint ~]$ history | grep pwd

  113  2013-06-09 10:40:12     pwd
  141  2013-06-09 10:40:12     pwd
  198  2013-06-09 15:46:23     history | grep pwd
  202  2013-06-09 15:47:39     history | grep pwd

11. Search Lastly Executed Command

Search previously executed command with ‘Ctrl+r’ command. Once you’ve found the command you’re looking for, press ‘Enter‘ to execute the same else press ‘esc‘ to cancel it.

(reverse-i-search)`source ': source .bash_profile

12. Recall Lastly Executed Command

Recall a previously used specific command. Combination of Bang and 8 (!8) command will recall number 8 command which you have executed.

[narad@tecmint ~]$ !8

13. Recall Lastly Executed Specific Command

Recall previously used command (netstat -np | grep 22) with ‘!‘ and followed by some letters of that particular command.

[narad@tecmint ~]$ !net
netstat -np | grep 22
(No info could be read for "-p": geteuid()=501 but you should be root.)
tcp        0     68 192.168.50.2:22             192.168.50.1:1857           ESTABLISHED -
tcp        0      0 192.168.50.2:22             192.168.50.1:2516           ESTABLISHED -
unix  2      [ ]         DGRAM                    12284  -                   @/org/freedesktop/hal/udev_event
unix  3      [ ]         STREAM     CONNECTED     14522  -
unix  2      [ ]         DGRAM                    13622  -
unix  3      [ ]         STREAM     CONNECTED     12250  -                   @/var/run/hald/dbus-ujAjOMNa0g
unix  3      [ ]         STREAM     CONNECTED     12249  -
unix  3      [ ]         STREAM     CONNECTED     12228  -                   /var/run/dbus/system_bus_socket
unix  3      [ ]         STREAM     CONNECTED     12227  -

We have tried to highlight power of history command. However, this is not end of it. Please share your experience of history command with us through our comment box below.

He has over 10 years of rich IT experience which includes various Linux Distros, FOSS and Networking. Narad always believes sharing IT knowledge with others and adopts new technology with ease.

Linux Services & Free WordPress Setup

Our post is simply ‘DIY’ aka ‘Do It Yourself, still you may find difficulties and want us to help you out. We offer wide range of Linux and Web Hosting Solutions at fair minimum rates. Please submit your orders by Clicking Here.

10 Responses

  1. 5. unset export HISTCONTROL

    This command unsets two variables, export and HISTCONTROL. It does not just remove HISTCONTROL from the environment; it unsets it entirely.

  2. Ron says:

    Thanks for #2.

  3. VIVEK says:

    Sir
    I am linux trainer. these cmds are very useful

    THANKYOU

    WITH REGARDS

    VIVEK

  4. Rahul says:

    Good one, I got a lot from this

  5. jack says:

    Hi

    I want history like below. is it possible ?

    year time command username

    05/12/13 11:07:36 ls -lah

    • Tom says:

      Hi Jack, of course it’s possible.

      Edit your ~/.bashrc and set the line
      HISTTIMEFORMAT
      to:
      HISTTIMEFORMAT=”%F %T “.

      Exit all your terminals and now it should write a timestamp in the history file.
      (Maybe you have to log out!)

  6. Lee says:

    We can modify History of command ..?

  7. rehan says:

    var/log/secure provides us below information :

    Mar 20 08:07:07 testing sshd[29749]: Accepted password for oracle from 10.51.1.12 port 49239 ssh2
    Mar 20 08:07:07 testing sshd[29749]: pam_unix(sshd:session): session opened for user oracle by (uid=0)
    Mar 20 08:12:16 testing sshd[29759]: Received disconnect from 10.51.1.12: 11: Disconnect requested by Windows SSH Client.
    Mar 20 08:12:16 testing sshd[29749]: pam_unix(sshd:session): session closed for user oracle

    But what commands that oracle user executed we can not get from the above information?

    /home/oracle/.bash_history provides us information like this about what commands are executed:
    exit
    cat /home/oracle/ashfaq/Auto_Clone/Auto_Clone.sh
    cat /u01/down.sh
    cd /u01/oracle/inst/apps/TESTING_testing/admin/scripts/
    ./adstpall.sh apps/apps
    ./adstrtal.sh apps/apps
    cat /home/oracle/ashfaq/Auto_Clone/Auto_Clone.sh
    ls -ltr
    cat main_exec.sh

    but does not tell us that user from which IP or hostname and at what time executed these commands.

    how we can store all this information in one file with time, IP, user name (root, oracle, ricky ) and commands executed by these users ?

  8. Subu says:

    Hi,

    We need the ssh session commands to be redirected to a file everytime they login.

    We have added the below lines under bashrc.

    HISTFILE=/var/tmp/history/$USER.$(date +%d-%m-%Y:%H:%M)
    readonly HISTFILE
    HISTSIZE=5000
    HISTTIMEFORMAT=”%d/%m/%y %T ”

    Its logging all the commands but, when we run history it shows only session history where we want that to show the complete history..

    Please help. thanks in advance.
    Subu.

Leave a Reply

© 2012-2013 All Rights Reserved.