How to see time stamps in bash history?

Is there any way I can see at what time the commands were executed from the bash history? We can see the order but is there any way I can get the time also?

Bottom-Line: Execution time in the Bash history

5

9 Answers

Press Ctrl+Alt+T to open a terminal, then run one of the commands below:

HISTTIMEFORMAT="%d/%m/%y %T " # for e.g. “29/02/99 23:59:59”
HISTTIMEFORMAT="%F %T " # for e.g. “1999-02-29 23:59:59”

To make the change permanent for the current user run:

echo 'HISTTIMEFORMAT="%d/%m/%y %T "' >> ~/.bashrc # or respectively
echo 'HISTTIMEFORMAT="%F %T "' >> ~/.bashrc
source ~/.bashrc

To test the effects run:

history

For more info see man bash or An A-Z Index of the Bash command line for Linux.

For commands that were run before HISTTIMEFORMAT was set, the current time will be saved as the timestamp. Commands run after HISTTIMEFORMAT was set will have the proper timestamp saved.

8

Open terminalCtrl+Alt+T and run,

HISTTIMEFORMAT="%d/%m/%y %T "

then,

history

To make the changes permanent follow the below steps,

gedit ~/.bashrc

you need to add the below line to .bashrc file and then save it,

export HISTTIMEFORMAT="%d/%m/%y %T "

run the below command to source .bashrc file,

source ~/.bashrc

After that run history command.

source:

3

Yes, you can: if you set $HISTTIMEFORMAT, the .bash-history will be properly timestamped. That doesn't help with existing .bash-history content, but will help in the future.

4

Changing HISTIMEFORMAT didn't work for me, because I'm using zsh.

If you want to make it work with zsh, you just have to type :history -i

1

You 'll see changes on next login.

echo 'HISTTIMEFORMAT="%d/%m/%y %T "' >> ~/.bashrc

My version that works

HISTTIMEFORMAT="%F %T %z " history | grep 'your command'

ref.

E.g.

╭you@your-server:/some/path
╰$ HISTTIMEFORMAT="%F %T %z "; history | grep 'some command' 1947 2019-12-17 15:54:34 +0800 ./some.sh 1948 2019-12-17 15:54:34 +0800 ./my-command

View full syntax for HISTTIMEFORMAT here

To enable history timestamps for all users, create a script in /etc/profile.d :

echo 'HISTTIMEFORMAT="%Y%m%d %T "' >> /etc/profile.d/timestamp.sh

2

I know, I'm answering it very late, but to do this for all the users, you can create any .sh file in /etc/profile.d and add the following line to it:

echo 'HISTTIMEFORMAT="%Y-%m-%d %T "' >> /etc/profile.d/existing-foo-file.sh

If you not logged in as root or superuser, you need to use the tee command to do this:

echo 'HISTTIMEFORMAT="%Y-%m-%d %T "' | sudo tee /etc/profile.d/mytimestamp.sh

If you want to append to any existing file, pass -a flag to tee command:

echo 'HISTTIMEFORMAT="%Y-%m-%d %T "' | sudo tee -a /etc/profile.d/mytimestamp.sh

4

I maintain a history per tty device per user, in .bash_profile, and let them grow large. Sometimes I want to find where a command was used across all those files using grep, say. I have just spent a while getting how I want, with time stamps as strings and headers for each file plus which tty before the time so if I am grepping I will see where and when used:

$ awk 'BEGIN{RS="#"; FS="\n"} {if (FNR == 1){ print "\n==>" FILENAME "<=="; tty=substr(FILENAME,15,9) }; if ((ln==0) && ($1 ~/^[0-9]+$/)){Cmd="date -r "$1""; Cmd | getline textDate; close(Cmd);baseD=substr(textDate,1,length(textDate)-5);baseS=$1}; if ($1 ~/^[0-9]+$/){printf "%s %s+%.2fH (%d)%s\n", tty, baseD, ($1-baseS)/3600, $1, $2; if (ln==0) {ln=20} else {ln--}}} ' .bash_history_ttys003|head
==>.bash_history_ttys003<==
ttys003 Thu 28 Sep 2017 10:45:48+0.00H (1506591948)cp Qlog t
ttys003 Thu 28 Sep 2017 10:45:48+6.12H (1506613974)grep \ 755\ Qlog
ttys003 Thu 28 Sep 2017 10:45:48+6.15H (1506614092)grep \ 769\ Qlog
ttys003 Thu 28 Sep 2017 10:45:48+6.16H (1506614130)locate akd
ttys003 Thu 28 Sep 2017 10:45:48+6.17H (1506614159)less /System/Library/LaunchAgents/com.apple.akd.plist
ttys003 Thu 28 Sep 2017 10:45:48+6.17H (1506614172)mN -K PLIST
ttys003 Thu 28 Sep 2017 10:45:48+6.18H (1506614179)man -k plist
ttys003 Thu 28 Sep 2017 10:45:48+6.18H (1506614213)man swapllist

Can't go into all the background as life is too short (LITS) but here are my dev notes as I worked it up. This is on macOS so no special gawk but I do use date -r where it may differ for you, date -d?. Enjoy! :

How would I list all .bash_history* lines that grep finds together with the Unix timestamp as string?
sample data lines in history (#unix time \n command)
head .bash_history_ttys007
\#1502956374
man top
\#1502956600
top
As 2 lines looks like an awk task...
Can't print FILENAME in begin as there is no current file at that stage :( so use FNR file rec numb check...
awk 'BEGIN{RS="#"} {if (FNR == 1){ print FILENAME }; "date -r "$1"" | getline textDate; close(date);print textDate, $0}'
awk 'BEGIN{RS="#"} {if (FNR == 1){ print FILENAME }; "date -r "$1"" | getline textDate; close(date);print textDate, $0}' .bash_history_ttys00[67]|head
Works but 3 lines per item as x0a line-returns are in there. WILL HAVE OTHER PROBLEMS TOO (later)...
Progress by field sep on new lines and carve up filename for controlling terminal
awk 'BEGIN{RS="#"; FS="\n"} {if (FNR == 1){ print "\n==>" FILENAME "<=="; tty=substr(FILENAME,15,9) }; if ($1 ~/^[0-9]+$/){"date -r "$1"" | getline textDate; close(date);print tty, substr(textDate,1,length(textDate)-1) ,"(" $1")", $2} }' .bash_history_ttys00[67]|head
$ awk 'BEGIN{RS="#"; FS="\n"} {if (FNR == 1){ print "\n==>" FILENAME "<=="; tty=substr(FILENAME,15,9) }; if ($1 ~/^[0-9]+$/){"date -r "$1"" | getline textDate; close(date -r "$1");print tty, substr(textDate,1,length(textDate)-1) ,"(" $1")", $2} }' .bash_history_ttys002
Works OK but runs a bit slow: just do dates every once in a while? then if grep-ing will probably miss it...
awk 'BEGIN{RS="#"; FS="\n"} {if (FNR == 1){ print "\n==>" FILENAME "<=="; tty=substr(FILENAME,15,9) }; if ($1 ~/^[0-9]+$/){Cmd="date -r "$1""; Cmd | getline textDate; close(Cmd);print tty, substr(textDate,1,length(textDate)-1) ,"(" $1")", $2} }' .bash_history_ttys002
Do occasional date convert and retain string and offset secs? this does run much faster and requires timestamps to avoid # in commands. About 5s for 20,000 commands for me.
awk 'BEGIN{RS="#"; FS="\n"} {if (FNR == 1){ print "\n==>" FILENAME "<=="; tty=substr(FILENAME,15,9) }; if ((ln==0) && ($1 ~/^[0-9]+$/)){Cmd="date -r "$1""; Cmd | getline textDate; close(Cmd);baseD=substr(textDate,1,length(textDate)-5);baseS=$1}; if ($1 ~/^[0-9]+$/){printf "%s %s+%.2fH (%d)%s\n", tty, baseD, ($1-baseS)/3600, $1, $2; if (ln==0) {ln=20} else {ln--}}} ' .bash_history_ttys003