Is there any way I can see at what time the commands were executed from the bash history? We can see the order but is there any way I can get the time also?
For commands that were run beforeHISTTIMEFORMAT was set, the current time will be saved as the timestamp. Commands run after HISTTIMEFORMAT was set will have the proper timestamp saved.
Yes, you can: if you set $HISTTIMEFORMAT, the .bash-history will be properly timestamped. That doesn't help with existing .bash-history content, but will help in the future.
I maintain a history per tty device per user, in .bash_profile, and let them grow large. Sometimes I want to find where a command was used across all those files using grep, say.
I have just spent a while getting how I want, with time stamps as strings and headers for each file plus which tty before the time so if I am grepping I will see where and when used:
Can't go into all the background as life is too short (LITS) but here are my dev notes as I worked it up. This is on macOS so no special gawk but I do use date -r where it may differ for you, date -d?. Enjoy! :
How would I list all .bash_history* lines that grep finds together with the Unix timestamp as string?
sample data lines in history (#unix time \n command)
head .bash_history_ttys007
\#1502956374
man top
\#1502956600
top
As 2 lines looks like an awk task...
Can't print FILENAME in begin as there is no current file at that stage :( so use FNR file rec numb check...
awk 'BEGIN{RS="#"} {if (FNR == 1){ print FILENAME }; "date -r "$1"" | getline textDate; close(date);print textDate, $0}'
awk 'BEGIN{RS="#"} {if (FNR == 1){ print FILENAME }; "date -r "$1"" | getline textDate; close(date);print textDate, $0}' .bash_history_ttys00[67]|head
Works but 3 lines per item as x0a line-returns are in there. WILL HAVE OTHER PROBLEMS TOO (later)...
Progress by field sep on new lines and carve up filename for controlling terminal
awk 'BEGIN{RS="#"; FS="\n"} {if (FNR == 1){ print "\n==>" FILENAME "<=="; tty=substr(FILENAME,15,9) }; if ($1 ~/^[0-9]+$/){"date -r "$1"" | getline textDate; close(date);print tty, substr(textDate,1,length(textDate)-1) ,"(" $1")", $2} }' .bash_history_ttys00[67]|head
$ awk 'BEGIN{RS="#"; FS="\n"} {if (FNR == 1){ print "\n==>" FILENAME "<=="; tty=substr(FILENAME,15,9) }; if ($1 ~/^[0-9]+$/){"date -r "$1"" | getline textDate; close(date -r "$1");print tty, substr(textDate,1,length(textDate)-1) ,"(" $1")", $2} }' .bash_history_ttys002
Works OK but runs a bit slow: just do dates every once in a while? then if grep-ing will probably miss it...
awk 'BEGIN{RS="#"; FS="\n"} {if (FNR == 1){ print "\n==>" FILENAME "<=="; tty=substr(FILENAME,15,9) }; if ($1 ~/^[0-9]+$/){Cmd="date -r "$1""; Cmd | getline textDate; close(Cmd);print tty, substr(textDate,1,length(textDate)-1) ,"(" $1")", $2} }' .bash_history_ttys002
Do occasional date convert and retain string and offset secs? this does run much faster and requires timestamps to avoid # in commands. About 5s for 20,000 commands for me.
awk 'BEGIN{RS="#"; FS="\n"} {if (FNR == 1){ print "\n==>" FILENAME "<=="; tty=substr(FILENAME,15,9) }; if ((ln==0) && ($1 ~/^[0-9]+$/)){Cmd="date -r "$1""; Cmd | getline textDate; close(Cmd);baseD=substr(textDate,1,length(textDate)-5);baseS=$1}; if ($1 ~/^[0-9]+$/){printf "%s %s+%.2fH (%d)%s\n", tty, baseD, ($1-baseS)/3600, $1, $2; if (ln==0) {ln=20} else {ln--}}} ' .bash_history_ttys003
Press Ctrl+Alt+T to open a terminal, then run one of the commands below:
To make the change permanent for the current user run:
To test the effects run:
For more info see man bash or An A-Z Index of the Bash command line for Linux.
For commands that were run before
HISTTIMEFORMATwas set, the current time will be saved as the timestamp. Commands run afterHISTTIMEFORMATwas set will have the proper timestamp saved.Open terminalCtrl+Alt+T and run,
then,
To make the changes permanent follow the below steps,
you need to add the below line to .bashrc file and then save it,
run the below command to source .bashrc file,
After that run
historycommand.source:http://www.cyberciti.biz/faq/unix-linux-bash-history-display-date-time/
Yes, you can: if you set
$HISTTIMEFORMAT, the.bash-historywill be properly timestamped. That doesn't help with existing.bash-historycontent, but will help in the future.Changing
HISTIMEFORMATdidn't work for me, because I'm using zsh.If you want to make it work with zsh, you just have to type :
history -iYou 'll see changes on next login.
My version that works
ref. https://www.linuxuprising.com/2019/07/bash-history-how-to-show-timestamp-when.html
E.g.
View full syntax for
HISTTIMEFORMAThereTo enable history timestamps for all users, create a script in /etc/profile.d :
I know, I'm answering it very late, but to do this for all the users, you can create any
.shfile in/etc/profile.dand add the following line to it:If you not logged in as
rootor superuser, you need to use theteecommand to do this:If you want to append to any existing file, pass
-aflag toteecommand:I maintain a history per tty device per user, in .bash_profile, and let them grow large. Sometimes I want to find where a command was used across all those files using grep, say. I have just spent a while getting how I want, with time stamps as strings and headers for each file plus which tty before the time so if I am grepping I will see where and when used:
Can't go into all the background as life is too short (LITS) but here are my dev notes as I worked it up. This is on macOS so no special gawk but I do use date -r where it may differ for you, date -d?. Enjoy! :