Categoria: GNU/Linux

Did you ever had a look at you bash history?

No? Well, try it issuing the following command:

root@moveaway: history

...
996  netstat -tapn
997  vi /etc/my.cnf
998  vi /etc/my.cnf
999  service mysql restart
1000  service mysqld restart
1001  history

Wow! One thousand (and one) commands issued on my laptop command line! Nice, insn’t it?

Well, ohhhh yess…but…mmm…when did I issue each command?

The default behaviour for the bash history file (.bash_history in your home directory), is to take note only of the commands, nothing else, as you can see “catting” the raw file:

root@moveaway: cat .bash_history
..
netstat -tapn
vi /etc/my.cnf
vi /etc/my.cnf
service mysql restart
service mysqld restart

Not that useful if you are trying to link some correlations from the commands you issued and what happened in your system. Better for you to timestamp you history log.

How to do it?

First, let’s pay attention to what

root@moveaway: man bash

tells us:

HISTTIMEFORMAT
If this variable is set and not null, its value is used as a format string for strftime(3) to print the time stamp associated with each his-
tory entry displayed by the history builtin. If this variable is set, time stamps are written to the history file so they may be preserved
across shell sessions.

So, setting the variable

HISTTIMEFORMAT

would give a relief to our concern. The syntax is similar the one you use for the command

date

so

man date

will help you to find a proper format string for this variable. Anyway, if you have no idea, here is a pre formatted variable (Year-Month-Day Hours:Minutes:Seconds)

HISTTIMEFORMAT="%Y-%m-%d %H:%M:%S "

This string alone won’t work, we have to “export” it as a environment variable:

export HISTTIMEFORMAT="%Y-%m-%d %H:%M:%S "

Mmm…let’s have a look to our history:

root@moveaway: history

997  2008-07-31 19:40:34 vi /etc/my.cnf
998  2008-07-31 19:40:34 vi /etc/my.cnf
999  2008-07-31 19:40:34 service mysql restart
1000  2008-07-31 19:40:34 service mysqld restart
1001  2008-07-31 19:40:37 history

Ouch! All the entries have the same date stamp! Well, to fix this we should exit the login session and logon again, but our environment variable would get lost. We must make it lasting through sessions. Let’s invoke the

man bash

command again:

When bash is invoked as an interactive login shell, or as a non-interactive shell with the –login option, it first reads and executes commands from
the file /etc/profile, if that file exists. After reading that file, it looks for ~/.bash_profile, ~/.bash_login, and ~/.profile, in that order,
and reads and executes commands from the first one that exists and is readable.

Interesting. It’s time to edit the

/etc/profile

file and write the command in, to make it last:

export HISTTIMEFORMAT="%Y-%m-%d %H:%M:%S "

Save the file, exit the login session and logon again. Now issue some commands…

root@moveaway: prova_time_stamp_1
-bash: prova_time_stamp_1: command not found
root@moveaway: prova_time_stamp_2
-bash: prova_time_stamp_2: command not found
root@moveaway: prova_time_stamp_3
-bash: prova_time_stamp_3: command not found
root@moveaway: history

Well, not real commands, but they will be a good placeholder to mark the timestamps. Let’s issue

history

again:

1001  2008-07-31 19:42:46 prova_time_stamp_1
1002  2008-07-31 19:42:54 prova_time_stamp_2
1003  2008-07-31 19:43:00 prova_time_stamp_3
1004  2008-07-31 19:43:25 history

It works! Now our history is marked with a time stamp for each entry, so it will be easier to understand when a command has been issued. Let’s have a look to the

.bash_history

file, but since the file is fully written only after the login session is closed, logoff, logon again and then issue:

root@moveaway: cat .bash_history
...
#1217533366
prova_time_stamp_1
#1217533374
prova_time_stamp_2
#1217533366
prova_time_stamp_3
#1217533405
history

What’s that? Each command is prefixed by a Unix Timestamp, which is converted for you by the

history

command, otherwise you can use an online converter.

Good, isn’t it?

2 Cent Tip:

If you want your history file to take note of more than the standard 500 commands, put in the

profile

the following string:

export HISTSIZE=1000

You will have a 1000 commands worth history file.

Second 2 Cent Tip:

If you want more infos on the time syntax for

HISTTIMEFORMAT

have a look to

man 3 strftime