Linux History Command

Linux Command History with date and time

Regarding this link you can make the first solution provided by krzyk permanent by executing:

echo 'export HISTTIMEFORMAT="%d/%m/%y %T "' >> ~/.bash_profile
source ~/.bash_profile

How can I see all of the bash history?

You should look into the histappend shell option and the -a flag to history:

histappend

If set, the history list is appended to the file named by the value of the HISTFILE variable when the shell exits, rather than overwriting the file.

history

-a Append the "new" history lines (history lines entered since the beginning of the current bash session) to the history file.

If you put history -a into your PROMPT_COMMAND, you'll get an always-up-to-date .bash_history file.

Where is linux terminal's session history stored?

Add these lines to your ~/.bashrc, and every single command from any session gets written to ~/.bash_history.

shopt -s histappend
export PROMPT_COMMAND='history -a'

... also saves you from sessions overwriting each others history.

HIstory command only showing last 15 commands

The history n command, where n is a number shows all history since line n. So in your case, history 904 will show the last 100 commands.

How to History of commands with dates in linux?

Not easily.

You can see who logged in from where with who or last.

You can see the history of the commands of the last shell which exited in their home folder in the file $HOME/.bash_history. BASH doesn't log the timestamp in this file, though, so there is no way to tell when the commands were executed. You can see this when you execute

HISTTIMEFORMAT="%d/%m/%y %T " history

A lot of the commands in the history will have the same date/time and if you look more closely, you'll see that this is in fact the date/time of the file .bash_history.

It should be possible to download the sources for BASH and compile your own version which does more extensive logging. Just be careful that you don't log commands read from script files (or your computer probably won't even boot anymore).

Also note that you need to do the same for all the shells which your users are using. And you need to make sure that they don't have their own copy of the shell.

Related:

  • How to log all Bash commands by all users on a server?
  • HOWTO BASH Audit / Command Logger

Where are the contents of the `history` command stored in Linux and Why does SIGKILL to the terminal doesn't prevent it from storing the commands?

According to man bash, the $PPID variable stores

The process ID of the shell's parent. This variable is readonly.

When you open a terminal in a graphical session, you have a process of a terminal emulator that presents a window for you and a bash (or other shell) running in it.
So when you execute the kill -KILL $PPID command you kill a process immediately, but not the bash itself but a GUI showing you a terminal. Then your bash process is somehow informed that its parent process dies (or maybe it looks for pseudo terminal close and not a parent process termination -- I don't know exactly) and exits cleanly.

But when you execute kill -KILL $PPID from sh launched from your bash, it is your bash that is "parent process" and that is killed immediately without the possibility to flush its history to file.



Related Topics



Leave a reply



Submit