Linux command history: Choosing what to remember and how

Linux history — the record of commands that you’ve used on the command line — can simplify repeating commands and provide some very useful information when you’re trying to track down how recent system or account changes might have come about.

Two things you need to understand before you begin your sleuthing, however, are that the shell’s command memory can be selective and that dates and times for when commands were run are optional.

Basic Linux history

Let’s first look at how dates and times are recorded when commands are entered on the command line. By default, they are not. The history command simply provides a list of previously used commands. That’s all that is saved in the history file. For bash users, this information all gets stuffed into the .bash_history file; for other shells, it might be just .history.

$ echo $HISTFILE
/home/myuser/.bash_history

How much command history is preserved is limited by the HISTSIZE setting if one has been set (usually the case). Most accounts are set up to record 100, 500 or 1,000 commands, and the older commands are overwritten by newer ones when that limit is exceeded.

$ echo $HISTSIZE
500

Another interesting behavior is that commands entered in the current login session are not added to the history file until you log off. Instead, they are written to a history buffer that is added to the history file at the end of the login session.

Adding dates and times to the history file

By default, the history file remembers only the commands themselves, not the dates/times when they were entered. And nothing you can do will provide information on when the commands were used in the past.

If you want to record the dates and times, you can add a command like this to one of the files that is run at login — like .bash_profile. Afterwards, you can source the file (. ~/.bash_profile) to make the change active right away or wait to your next login for the change to be effective.

$ echo export HISTTIMEFORMAT="%m/%d/%y %T " >> ~/.bash_profile

The format you choose will determine how your command history will be displayed, but not how it will be recorded. Date and time information will be displayed in a format like the “02/20/18 09:10:11 ” when a setting like that shown above is used. Each portion of the time format stands for a date component.

y	year in 2-digit format
Y	year in 4-digit format
m	month in 2-digit format
d	day in 2-digit format
T	time in 24-hour format
%r	date in 12 hour AM/PM format
%D	date in mm/dd/yy format

Don’t neglect the blank before the closing quote in your HISTTIMEFORMAT setting, or your dates and commands will run together like this:

   11  02/19/18 21:19:21cat .bash_profile
   12  02/19/18 21:19:27vi .bash_profile
   13  02/19/18 21:20:06echo $HISTCONTROL

Once you select a date format, dates and times will be added to your history file. However, no dates will be added to records previously added in the file. Instead, once the change is effective, you’ll see dates and times associated with those commands, but they’ll simply reflect the earliest recorded time in the file — not the dates and times those commands were actually entered.

If you change your mind about the date format, no problem. Your command history will display the date/time information in whatever format is current when you use the history command. This demonstrates that the timestamps stored in the history file are independent of the display format you’ve selected. In fact, the date/time information will be stored in your history file in this form:

1519083591

“What is that?” you might ask. It’s a display of the time in the infamous Unix “epoch” format — the number of seconds since the beginning of all things Unix/Linux. If you want to see some conversions at work, check out this epoch converter. If you want to see how these timestamps are stored, dump your history file using the od command, you’ll see lines like this:

0016440 171 012 043 061 065 061 071 060 070 063 065 071 061 012 157 144
          y  n   #   1   5   1   9   0   8   3   5   9   1  n   o   d
0016460 040 055 142 143 040 056 142 141 163 150 137 150 151 163 164 157
              -   b   c       .   b   a   s   h   _   h   i   s   t   o

Notice that 1519083591 number in there? The converter could tell you that that number stands for Monday, February 19, 2018 11:39:51 PM GMT. Interestingly, this value is not actually stored numerically, but as a series of characters that represent the timestamp (i.e., character 1, character 5 and so on).

Implementing selective memory

There are two ways that selective memory comes into play. For one, you can keep the commands that you’ve entered in the current login session from being added to your history file. Remember that they are not added to that file until you log out. If you clear your session history with history -c before you log out, those commands will be forgotten.

Another option is to have the shell ignore commands that start with blanks. In other words, if you type “  pwd” instead of “pwd”, the command will not be recorded in your history file. For this feature to be in effect, you need to set your HISTCONTROL setting to “ignorespace”.

$ export HISTCONTROL=ignorespace

Other settings include ignoredups (ignore repeats of a command when entered in succession) and ignoreboth (ignore both commands that begin with spaces and duplicates). To use more than one of these settings, separate them in your HISTCONTROL variable with colons. For example:

$ export HISTCONTROL=ignorespace:ignoredups

If you want this setting to be in effect all the time, add the command shown to one of the files (e.g., .bash_profile) that is read when you log in, and check to make sure it is set properly the next time you log in.

$ echo $HISTCONTROL
ignorespace:ignoredups

Wrap-up

You can’t change history, but you can control how it’s recorded — at least you can on Linux.