Linux Command History with date and time
Regarding this link you can make the first solution provided by krzyk permanent by executing:
echo 'export HISTTIMEFORMAT="%d/%m/%y %T "' >> ~/.bash_profile
source ~/.bash_profile
How can I see all of the bash history?
You should look into the histappend
shell option and the -a
flag to history
:
histappend
If set, the history list is appended to the file named by the value of the
HISTFILE
variable when the shell exits, rather than overwriting the file.
history
-a
Append the "new" history lines (history lines entered since the beginning of the current bash session) to the history file.
If you put history -a
into your PROMPT_COMMAND
, you'll get an always-up-to-date .bash_history
file.
Where is linux terminal's session history stored?
Add these lines to your ~/.bashrc
, and every single command from any session gets written to ~/.bash_history
.
shopt -s histappend
export PROMPT_COMMAND='history -a'
... also saves you from sessions overwriting each others history.
HIstory command only showing last 15 commands
The history n
command, where n
is a number shows all history since line n. So in your case, history 904
will show the last 100 commands.
How to History of commands with dates in linux?
Not easily.
You can see who logged in from where with who
or last
.
You can see the history of the commands of the last shell which exited in their home folder in the file $HOME/.bash_history
. BASH doesn't log the timestamp in this file, though, so there is no way to tell when the commands were executed. You can see this when you execute
HISTTIMEFORMAT="%d/%m/%y %T " history
A lot of the commands in the history will have the same date/time and if you look more closely, you'll see that this is in fact the date/time of the file .bash_history
.
It should be possible to download the sources for BASH and compile your own version which does more extensive logging. Just be careful that you don't log commands read from script files (or your computer probably won't even boot anymore).
Also note that you need to do the same for all the shells which your users are using. And you need to make sure that they don't have their own copy of the shell.
Related:
- How to log all Bash commands by all users on a server?
- HOWTO BASH Audit / Command Logger
Where are the contents of the `history` command stored in Linux and Why does SIGKILL to the terminal doesn't prevent it from storing the commands?
According to man bash
, the $PPID
variable stores
The process ID of the shell's parent. This variable is readonly.
When you open a terminal in a graphical session, you have a process of a terminal emulator that presents a window for you and a bash
(or other shell) running in it.
So when you execute the kill -KILL $PPID
command you kill a process immediately, but not the bash
itself but a GUI showing you a terminal. Then your bash
process is somehow informed that its parent process dies (or maybe it looks for pseudo terminal close and not a parent process termination -- I don't know exactly) and exits cleanly.
But when you execute kill -KILL $PPID
from sh
launched from your bash
, it is your bash
that is "parent process" and that is killed immediately without the possibility to flush its history to file.
Related Topics
Linux Device Driver Unsafe Fxsave/Fxrstor Bug - Any Precedents
How to Run .Exe Executable File from Linux Command Line
Show Image Notification from Bash Script
What Is a Good Interface for a Linux Device Driver for a Co-Processing Peripheral
Getting Uptime or Downtime of Systemd Process Using Systemctl
Releasing All Keys After Disabling The Keyboard in X11/Linux Using Xinput
Will Java Compiled in Windows Work in Linux
Cmake: Don't Set Rpath for a Single Library Used in Link
See What Process Last Touched a File
Reading Memory Pointed by Register with Gdb
Replace in a CSV File Value of a Column
Stty: Standard Input: Inappropriate Ioctl for Device
Enabling The Vt-X Inside a Virtual Machine
Re-Stream a Mpeg2 Ts Pal Stream with Crtmpserver