The Power of Linux “History Command” in Bash Shell

We use history command frequently in our daily routine jobs to check history of command or to get info about command executed by user. In this post, we will see how we can use history command effectively to extract the command which was executed by users in Bash shell. This may be useful for audit purpose or to find out what command is executed at what date and time.

By default date and timestamp won’t be seen while executing history command. However, bash shell provides CLI tools for editing user’s command history. Let’s see some handy tips and tricks and power of history command.

history command examples

1. List Last/All Executed Commands in Linux

Executing simple history command from terminal will show you a complete list of last executed commands with line numbers.

[narad@tecmint ~]$ history
1  PS1='\e[1;35m[\u@\h \w]\$ \e[m '
2  PS1="\e[0;32m[\u@\h \W]\$ \e[m "
3  PS1="\u@\h:\w [\j]\$ "
4  ping google.com
5  echo $PS1
6   tail -f /var/log/messages
7  tail -f /var/log/messages
8  exit
9  clear
10  history
11  clear
12  history

2. List All Commands with Date and Timestamp

How to find date and timestamp against command? With ‘export’ command with variable will display history command with corresponding timestamp when the command was executed.

[narad@tecmint ~]$ export HISTTIMEFORMAT='%F %T  '
1  2013-06-09 10:40:12   cat /etc/issue
2  2013-06-09 10:40:12   clear
3  2013-06-09 10:40:12   find /etc -name *.conf
4  2013-06-09 10:40:12   clear
5  2013-06-09 10:40:12   history
6  2013-06-09 10:40:12   PS1='\e[1;35m[\u@\h \w]\$ \e[m '
7  2013-06-09 10:40:12   PS1="\e[0;32m[\u@\h \W]\$ \e[m "
8  2013-06-09 10:40:12   PS1="\u@\h:\w [\j]\$ "
9  2013-06-09 10:40:12   ping google.com
10  2013-06-09 10:40:12   echo $PS1

Meaning of HISTTIMEFORMAT variables

%F Equivalent to %Y - %m - %d
%T Replaced by the time ( %H : %M : %S )

3. Filter Commands in History

As we can see same command is being repeated number of times in above output. How to filter simple or non destructive commands in history?. Use the following ‘export‘ command by specifying command in HISTIGNORE=’ls -l:pwd:date:’ will not saved by system and not be shown in history command.

[narad@tecmint ~]$ export HISTIGNORE='ls -l:pwd:date:'

4. Ignore Duplicate Commands in History

With the below command will help us to ignore duplicate commands entry made by user. Only single entry will be shown in history, if a user execute a same command multiple times in a Bash Prompt.

[narad@tecmint ~]$ export HISTCONTROL=ignoredups

5. Unset export Command

Unset export command on the fly. Execute unset export command with variable one by one whatever commands have been exported by export command.

      ▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬

                                                    ► Read more: http://adf.ly/1n7TZn

      ▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬