Is there any way I can see at what time the commands were executed from the bash history? We can see the order but is there any way I can get the time also?
Bottom-Line: Execution time in the Bash history
Asked
Active
Viewed 7.2e+01k times
9 Answers
490
Press Ctrl+Alt+T to open a terminal, then run one of the commands below:
HISTTIMEFORMAT="%d/%m/%y %T " # for e.g. “29/02/99 23:59:59”
HISTTIMEFORMAT="%F %T " # for e.g. “1999-02-29 23:59:59”
To make the change permanent for the current user run:
echo 'HISTTIMEFORMAT="%d/%m/%y %T "' >> ~/.bashrc # or respectively
echo 'HISTTIMEFORMAT="%F %T "' >> ~/.bashrc
source ~/.bashrc
To test the effects run:
history
For more info see man bash or An A-Z Index of the Bash command line for Linux.
For commands that were run before HISTTIMEFORMAT was set, the current time will be saved as the timestamp. Commands run after HISTTIMEFORMAT was set will have the proper timestamp saved.
106
Open terminalCtrl+Alt+T and run,
HISTTIMEFORMAT="%d/%m/%y %T "
then,
history
To make the changes permanent follow the below steps,
gedit ~/.bashrc
you need to add the below line to .bashrc file and then save it,
export HISTTIMEFORMAT="%d/%m/%y %T "
run the below command to source .bashrc file,
source ~/.bashrc
After that run history command.
source:http://www.cyberciti.biz/faq/unix-linux-bash-history-display-date-time/
Seth
- 59,332
Avinash Raj
- 80,446
25
Yes, you can: if you set $HISTTIMEFORMAT, the .bash-history will be properly timestamped. That doesn't help with existing .bash-history content, but will help in the future.
Dennis Kaarsemaker
- 6,904
19
Changing HISTIMEFORMAT didn't work for me, because I'm using zsh.
If you want to make it work with zsh, you just have to type :
history -i
Jack'
- 291
3
My version that works
HISTTIMEFORMAT="%F %T %z " history | grep 'your command'
ref. https://www.linuxuprising.com/2019/07/bash-history-how-to-show-timestamp-when.html
E.g.
╭you@your-server:/some/path
╰$ HISTTIMEFORMAT="%F %T %z "; history | grep 'some command'
1947 2019-12-17 15:54:34 +0800 ./some.sh
1948 2019-12-17 15:54:34 +0800 ./my-command
View full syntax for HISTTIMEFORMAT here
Nam G VU
- 2,378
2
To enable history timestamps for all users, create a script in /etc/profile.d :
echo 'HISTTIMEFORMAT="%Y%m%d %T "' >> /etc/profile.d/timestamp.sh
iii
- 145
1
I maintain a history per tty device per user, in .bash_profile, and let them grow large. Sometimes I want to find where a command was used across all those files using grep, say. I have just spent a while getting how I want, with time stamps as strings and headers for each file plus which tty before the time so if I am grepping I will see where and when used:
$ awk 'BEGIN{RS="#"; FS="\n"} {if (FNR == 1){ print "\n==>" FILENAME "<=="; tty=substr(FILENAME,15,9) }; if ((ln==0) && ($1 ~/^[0-9]+$/)){Cmd="date -r "$1""; Cmd | getline textDate; close(Cmd);baseD=substr(textDate,1,length(textDate)-5);baseS=$1}; if ($1 ~/^[0-9]+$/){printf "%s %s+%.2fH (%d)%s\n", tty, baseD, ($1-baseS)/3600, $1, $2; if (ln==0) {ln=20} else {ln--}}} ' .bash_history_ttys003|head
==>.bash_history_ttys003<==
ttys003 Thu 28 Sep 2017 10:45:48+0.00H (1506591948)cp Qlog t
ttys003 Thu 28 Sep 2017 10:45:48+6.12H (1506613974)grep \ 755\ Qlog
ttys003 Thu 28 Sep 2017 10:45:48+6.15H (1506614092)grep \ 769\ Qlog
ttys003 Thu 28 Sep 2017 10:45:48+6.16H (1506614130)locate akd
ttys003 Thu 28 Sep 2017 10:45:48+6.17H (1506614159)less /System/Library/LaunchAgents/com.apple.akd.plist
ttys003 Thu 28 Sep 2017 10:45:48+6.17H (1506614172)mN -K PLIST
ttys003 Thu 28 Sep 2017 10:45:48+6.18H (1506614179)man -k plist
ttys003 Thu 28 Sep 2017 10:45:48+6.18H (1506614213)man swapllist
Can't go into all the background as life is too short (LITS) but here are my dev notes as I worked it up. This is on macOS so no special gawk but I do use date -r where it may differ for you, date -d?. Enjoy! :
How would I list all .bash_history* lines that grep finds together with the Unix timestamp as string?
sample data lines in history (#unix time \n command)
head .bash_history_ttys007
\#1502956374
man top
\#1502956600
top
As 2 lines looks like an awk task...
Can't print FILENAME in begin as there is no current file at that stage :( so use FNR file rec numb check...
awk 'BEGIN{RS="#"} {if (FNR == 1){ print FILENAME }; "date -r "$1"" | getline textDate; close(date);print textDate, $0}'
awk 'BEGIN{RS="#"} {if (FNR == 1){ print FILENAME }; "date -r "$1"" | getline textDate; close(date);print textDate, $0}' .bash_history_ttys00[67]|head
Works but 3 lines per item as x0a line-returns are in there. WILL HAVE OTHER PROBLEMS TOO (later)...
Progress by field sep on new lines and carve up filename for controlling terminal
awk 'BEGIN{RS="#"; FS="\n"} {if (FNR == 1){ print "\n==>" FILENAME "<=="; tty=substr(FILENAME,15,9) }; if ($1 ~/^[0-9]+$/){"date -r "$1"" | getline textDate; close(date);print tty, substr(textDate,1,length(textDate)-1) ,"(" $1")", $2} }' .bash_history_ttys00[67]|head
$ awk 'BEGIN{RS="#"; FS="\n"} {if (FNR == 1){ print "\n==>" FILENAME "<=="; tty=substr(FILENAME,15,9) }; if ($1 ~/^[0-9]+$/){"date -r "$1"" | getline textDate; close(date -r "$1");print tty, substr(textDate,1,length(textDate)-1) ,"(" $1")", $2} }' .bash_history_ttys002
Works OK but runs a bit slow: just do dates every once in a while? then if grep-ing will probably miss it...
awk 'BEGIN{RS="#"; FS="\n"} {if (FNR == 1){ print "\n==>" FILENAME "<=="; tty=substr(FILENAME,15,9) }; if ($1 ~/^[0-9]+$/){Cmd="date -r "$1""; Cmd | getline textDate; close(Cmd);print tty, substr(textDate,1,length(textDate)-1) ,"(" $1")", $2} }' .bash_history_ttys002
Do occasional date convert and retain string and offset secs? this does run much faster and requires timestamps to avoid # in commands. About 5s for 20,000 commands for me.
awk 'BEGIN{RS="#"; FS="\n"} {if (FNR == 1){ print "\n==>" FILENAME "<=="; tty=substr(FILENAME,15,9) }; if ((ln==0) && ($1 ~/^[0-9]+$/)){Cmd="date -r "$1""; Cmd | getline textDate; close(Cmd);baseD=substr(textDate,1,length(textDate)-5);baseS=$1}; if ($1 ~/^[0-9]+$/){printf "%s %s+%.2fH (%d)%s\n", tty, baseD, ($1-baseS)/3600, $1, $2; if (ln==0) {ln=20} else {ln--}}} ' .bash_history_ttys003
colin
- 11
0
I know, I'm answering it very late, but to do this for all the users, you can create any .sh file in /etc/profile.d and add the following line to it:
echo 'HISTTIMEFORMAT="%Y-%m-%d %T "' >> /etc/profile.d/existing-foo-file.sh
If you not logged in as root or superuser, you need to use the tee command to do this:
echo 'HISTTIMEFORMAT="%Y-%m-%d %T "' | sudo tee /etc/profile.d/mytimestamp.sh
If you want to append to any existing file, pass -a flag to tee command:
echo 'HISTTIMEFORMAT="%Y-%m-%d %T "' | sudo tee -a /etc/profile.d/mytimestamp.sh
Shashank Agrawal
- 109