Bash History: Display Date And Time For Each Command

Posted on in Categories , , , , , , , , last updated January 18, 2017

How do I display shell command history with date and time under a Linux, MacOS or Unix-like operating systems?

The bash shell provides access to the command history, the list of commands previously typed. The value of the HISTSIZE variable is used as the number of commands to save in a history list. If the HISTTIMEFORMAT is set, the time stamp information associated with each history entry is written to the history file, marked with the history comment character.

How to see time stamps in bash history

Defining the environment variable named HISTTIMEFORMAT as follows:
$ HISTTIMEFORMAT="%d/%m/%y %T "
OR add to your ~/.bash_profile file, enter:
$ echo 'export HISTTIMEFORMAT="%d/%m/%y %T "' >> ~/.bash_profile
Where,

  1. %d – Day
  2. %m – Month
  3. %y – Year
  4. %T – Time

Use the source command to load HISTTIMEFORMAT from file into the current shell script or a command prompt:
$ . ~/.bash_profile
OR
$ source ~/.bash_profile

How to retrieve Linux or Unix bash command line history by date and time

Now, to see history, type:
$ history
Sample outputs:

....
..
  986  11/03/10 04:31:36 memcached-tool  10.10.28.22:11211 stats
  987  11/03/10 04:31:36 w
  988  11/03/10 04:31:37 iostat 
  989  11/03/10 04:31:37 top
  990  11/03/10 04:31:37 at
  991  11/03/10 04:31:38 atop
  992  11/03/10 04:31:40 collectl 
  993  11/03/10 04:31:41 grep CPU /proc/cpuinfo 
  994  11/03/10 04:31:45 vmstat 3 100
  995  11/03/10 04:31:55 sar -W -f /var/log/sa/sa12
....
..

Here is another output from my Ubuntu Linux server:

Fig.01: Adding date and time to my bash history
Fig.01: Adding date and time to my bash history

References:

For more info type the following commands:
man bash
help history
man 3 strftime

Posted by: Vivek Gite

The author is the creator of nixCraft and a seasoned sysadmin and a trainer for the Linux operating system/Unix shell scripting. He has worked with global clients and in various industries, including IT, education, defense and space research, and the nonprofit sector. Follow him on Twitter, Facebook, Google+.

Share this on (or read 40 comments/add one below):

40 comment

  11. @LA, you need to configure system accounting and auditing which can keep track of all user activities, system resource consumptions and more. History is personal user account specific tool. Also, user can delete history or ignore history file. Search our site for sar and auditing howtos.

    @cindy, refer to your local bash man page. You can find out bash version number with the following command:
    echo $BASH_VERSION

    Reply Report comment

  12. Yes, I figured my bash is way too old to have this environment variable. The version that I have is “GNU bash, version 2.03.0(1)-release” and all the examples I found online is above 3.0. My collegue searched the “HISTTIMEFORMAT” in some man pages for history and other, we cannot find this variable. But it’s a nice tip to use. :(
    Thanks!

    Reply Report comment

  14. you can add it to /etc/profile so it is available to all users. I also add:

    # Make sure all terminals save history
    shopt -s histappend histreedit histverify
    shopt -s no_empty_cmd_completion # bash>=2.04 only

    # Whenever displaying the prompt, write the previous line to disk:
    PROMPT_COMMAND=’history -a’

    #Use GREP color features by default: This will highlight the matched words / regexes
    export GREP_OPTIONS=’–color=auto’
    export GREP_COLOR=’1;37;41′

    Reply Report comment

  15. Good tip. We have multiple users connecting as root using ssh and running different commands. Is there a way to log the IP that command was run from?
    Thanks in advance.

    Reply Report comment

    1. Just for anyone who might still find this thread (like I did today):

      export HISTTIMEFORMAT=”%F %T : $(echo $SSH_CONNECTION | cut -d\ -f1) : ”

      will give you the time format, plus the IP address culled from the ssh_connection environment variable (thanks for pointing that out, Cadrian, I never knew about that before), all right there in your history output.

      You could even add in $(whoami)@ right to get if you like (although if everyone’s logging in with the root account that’s not helpful).

      Reply Report comment

  16. Yup, you can export one of this

    env | grep SSH
    SSH_CLIENT=192.168.78.22 42387 22
    SSH_TTY=/dev/pts/0
    SSH_CONNECTION=192.168.78.22 42387 192.168.36.76 22

    As their bash history filename

    set |grep -i hist
    HISTCONTROL=ignoreboth
    HISTFILE=/home/cadrian/.bash_history
    HISTFILESIZE=1000000000
    HISTSIZE=10000000

    So in profile you can so something like HISTFILE=/root/.bash_history_$(echo $SSH_CONNECTION| cut -d\ -f1)

    Reply Report comment

    1. Hi Sohail,

      Yes indeed that will be the behavior of the system since you have just enabled on that day the HISTTIMEFORMAT feature. In other words, the system recall or record the commands which were inputted prior enabling of this feature. Hope this answers your concern.

      Thanks!

      Reply Report comment

      1. Hi Sohail,

        Yes, that will be the behavior of the system since you have just enabled on that day the HISTTIMEFORMAT feature. In other words, the system can’t recall or record the commands which were inputted prior enabling of this feature, thus it will just reflect on the printed output (upon execution of “history”) the current day and time. Hope this answers your concern.

        Thanks!

        Reply Report comment

  23. hi vivek.do u know any openings for freshers in linux field? I m doing rhce course from rajiv banergy. My samba,nfs-nis,dhcp,telnet,ftp,http,ssh,squid,cron,quota and system administration is over.iptables ,sendmail and dns is remaining.

    -9029917299(Nitiratna)

    Reply Report comment

  27. The command is not working properly. It is displaying the date and time of todays for all the commands where as I ran the some command three before.

    How come it is displaying the today date

    Reply Report comment

  28. Hi..

    I want to collect the history of particular user everyday and want to send an email.I wrote below script.
    for collecting everyday history by time shall i edit .profile file of that user
    echo 'export HISTTIMEFORMAT="%d/%m/%y %T "' >> ~/.bash_profile
    Script:

    #!/bin/bash
#This script sends email of particular user
history >/tmp/history
if [ -s /tmp/history ]
then
       mailx -s "history 29042014"  </tmp/history
           fi
rm /tmp/history
#END OF THE SCRIPT

    Can any one suggest better way to collect particular user history for everyday

    Reply Report comment

  32. Hi All,

    I Have enabled my history with the command given :
    echo ‘export HISTTIMEFORMAT=”%d/%m/%y %T “‘ >> ~/.bash_profile

    i need to know how i can add the ip’s also , from which the commands are fired to the system.

    Reply Report comment

Leave a Comment

Tagged as: Tags , , , , , , , , , , , , , , , ,