How do I display shell command history with date and time under UNIX or Linux operating systems?
If the HISTTIMEFORMAT is set, the time stamp information associated with each history entry is written to the history file, marked with the history comment character. Defining the environment variable as follows:
$ HISTTIMEFORMAT="%d/%m/%y %T "
OR
$ echo 'export HISTTIMEFORMAT="%d/%m/%y %T "' >> ~/.bash_profile
Where,
%d - Day
%m - Month
%y - Year
%T - Time
To see history type
$ history
Sample outputs:
.... .. 986 11/03/10 04:31:36 memcached-tool 10.10.28.22:11211 stats 987 11/03/10 04:31:36 w 988 11/03/10 04:31:37 iostat 989 11/03/10 04:31:37 top 990 11/03/10 04:31:37 at 991 11/03/10 04:31:38 atop 992 11/03/10 04:31:40 collectl 993 11/03/10 04:31:41 grep CPU /proc/cpuinfo 994 11/03/10 04:31:45 vmstat 3 100 995 11/03/10 04:31:55 sar -W -f /var/log/sa/sa12 .... ..
References:
For more info type the following commands:
man bash
help history
man 3 strftime
Featured Articles:
- 20 Linux System Monitoring Tools Every SysAdmin Should Know
- 20 Linux Server Hardening Security Tips
- My 10 UNIX Command Line Mistakes
- Linux: 20 Iptables Examples For New SysAdmins
- 25 PHP Security Best Practices For Sys Admins
- The Novice Guide To Buying A Linux Laptop
- 10 Greatest Open Source Software Of 2009
- Top 5 Email Client For Linux, Mac OS X, and Windows Users
- Top 20 OpenSSH Server Best Security Practices
- Top 10 Open Source Web-Based Project Management Software
- Top 5 Linux Video Editor Software
Facebook it - Tweet it - Print it -
{ 21 comments… read them below or add one }
Errant ‘ ” ‘; ought it to read:
echo ‘export HISTTIMEFORMAT=”%d/%m/%y %T ‘ >> ~/.bash_profile
?
Deej
Ha, ha – even I messed up ! I see the command has now been amended.
echo ‘export HISTTIMEFORMAT=”%d/%m/%y %T ” ‘>> ~/.bash_profile
Deej
End single quote is missing.
Correct command is:
echo ‘export HISTTIMEFORMAT=”%d/%m/%y %T “‘ >> ~/.bash_profile
@Deej / Abhijeet,
Thanks for the heads up. Due to caching it takes a few seconds to minutes to clean out old html page cache. The faq has been updated.
Thanks, this helps a lot in an enterprise domain, where different ppl run different commands. Nice trick;)
how to set this on solaris 10 and how to refresh local.login in solaris …
This is bash specific feature. Refer to your local ksh(1) man page or see fc -l. But, there is no $HISTTIMEFORMAT for ksh.
awesome tip. i’ve forgoten to pursue this, but i’ve always wanted to add that to my bash hist file
thx
Is there a way to have cumulative history file where commands typed by all users are logged with date and time?
I don’t think this tip works for all version of Bash? Because I couldn’t get it working even I put this line in .bash_profile and .profile.
@LA, you need to configure system accounting and auditing which can keep track of all user activities, system resource consumptions and more. History is personal user account specific tool. Also, user can delete history or ignore history file. Search our site for sar and auditing howtos.
@cindy, refer to your local bash man page. You can find out bash version number with the following command:
echo $BASH_VERSIONYes, I figured my bash is way too old to have this environment variable. The version that I have is “GNU bash, version 2.03.0(1)-release” and all the examples I found online is above 3.0. My collegue searched the “HISTTIMEFORMAT” in some man pages for history and other, we cannot find this variable. But it’s a nice tip to use. :(
Thanks!
I would also add
$ echo 'export HISTSIZE=10000' >> ~/.bash_profileIt’s really useful, I think.
you can add it to /etc/profile so it is available to all users. I also add:
# Make sure all terminals save history
shopt -s histappend histreedit histverify
shopt -s no_empty_cmd_completion # bash>=2.04 only
# Whenever displaying the prompt, write the previous line to disk:
PROMPT_COMMAND=’history -a’
#Use GREP color features by default: This will highlight the matched words / regexes
export GREP_OPTIONS=’–color=auto’
export GREP_COLOR=’1;37;41′
Good tip. We have multiple users connecting as root using ssh and running different commands. Is there a way to log the IP that command was run from?
Thanks in advance.
Yup, you can export one of this
env | grep SSH
SSH_CLIENT=192.168.78.22 42387 22
SSH_TTY=/dev/pts/0
SSH_CONNECTION=192.168.78.22 42387 192.168.36.76 22
As their bash history filename
set |grep -i hist
HISTCONTROL=ignoreboth
HISTFILE=/home/cadrian/.bash_history
HISTFILESIZE=1000000000
HISTSIZE=10000000
So in profile you can so something like HISTFILE=/root/.bash_history_$(echo $SSH_CONNECTION| cut -d\ -f1)
bash 4 can syslog every command bat afaik, you have to recompile it (check file config-top.h). See the news file of bash: http://tiswww.case.edu/php/chet/bash/NEWS
If you want to safely export history of your luser, you can ssl-syslog them to a central syslog server.
This is good command, It helps me a lot.
You only need to use
in your .bash_profile
— show history with date & time
# HISTTIMEFORMAT=’%c ‘
#history
Hi
Nice trick but unfortunately, the commands which were executed in the past few days also are carrying the current day’s (today’s) timestamp.
Please advice.
Regards