{"id":12619,"date":"2019-03-28T04:01:46","date_gmt":"2019-03-28T04:01:46","guid":{"rendered":"http:\/\/www.appservgrid.com\/paw92\/?p=12619"},"modified":"2019-03-28T04:01:46","modified_gmt":"2019-03-28T04:01:46","slug":"the-power-of-linux-history-command-in-bash-shell","status":"publish","type":"post","link":"https:\/\/www.appservgrid.com\/paw92\/index.php\/2019\/03\/28\/the-power-of-linux-history-command-in-bash-shell\/","title":{"rendered":"The Power of Linux \u201cHistory Command\u201d in Bash Shell"},"content":{"rendered":"

We use\u00a0history<\/b>\u00a0command frequently in our daily routine jobs to check history of command or to get info about command executed by user. In this post, we will see how we can use history command effectively to extract the command which was executed by users in Bash shell. This may be useful for audit purpose or to find out what command is executed at what\u00a0date<\/strong>\u00a0and\u00a0time<\/strong>.<\/p>\n

By default\u00a0date<\/strong>\u00a0and\u00a0timestamp<\/strong>\u00a0won\u2019t be seen while executing\u00a0history<\/strong>\u00a0command. However, bash shell provides\u00a0CLI<\/strong>\u00a0tools for editing user\u2019s command history. Let\u2019s see some handy tips and tricks and power of\u00a0history<\/b>command.<\/p>\n

\n

\"linux<\/a><\/p>\n

history command examples<\/p>\n<\/div>\n

1. List Last\/All Executed Commands in Linux<\/h3>\n

Executing simple\u00a0history<\/b>\u00a0command from terminal will show you a complete list of last executed commands with line numbers.<\/p>\n

[narad@tecmint ~]$ history\r\n\r\n    1  PS1='\\e[1;35m[\\u@\\h \\w]$ \\e[m '\r\n    2  PS1=\"\\e[0;32m[\\u@\\h \\W]$ \\e[m \"\r\n    3  PS1=\"\\u@\\h:\\w [\\j]$ \"\r\n    4  ping google.com\r\n    5  echo $PS1\r\n    6   tail -f \/var\/log\/messages\r\n    7  tail -f \/var\/log\/messages\r\n    8  exit\r\n    9  clear\r\n   10  history\r\n   11  clear\r\n   12  history<\/pre>\n
2. List All Commands with Date and Timestamp<\/h3>\n
How to find\u00a0date\u00a0<\/b>and\u00a0timestamp<\/b>\u00a0against command? With\u00a0\u2018export\u2019<\/b>\u00a0command with variable will display history command with corresponding timestamp when the command was executed.<\/p>\n
[narad@tecmint ~]$ export HISTTIMEFORMAT='%F %T  '\r\n\r\n      1  2013-06-09 10:40:12   cat \/etc\/issue\r\n      2  2013-06-09 10:40:12   clear\r\n      3  2013-06-09 10:40:12   find \/etc -name *.conf\r\n      4  2013-06-09 10:40:12   clear\r\n      5  2013-06-09 10:40:12   history\r\n      6  2013-06-09 10:40:12   PS1='\\e[1;35m[\\u@\\h \\w]$ \\e[m '\r\n      7  2013-06-09 10:40:12   PS1=\"\\e[0;32m[\\u@\\h \\W]$ \\e[m \"\r\n      8  2013-06-09 10:40:12   PS1=\"\\u@\\h:\\w [\\j]$ \"\r\n      9  2013-06-09 10:40:12   ping google.com\r\n     10  2013-06-09 10:40:12   echo $PS1<\/pre>\n
Meaning of HISTTIMEFORMAT variables<\/h5>\n
%F Equivalent to %Y - %m - %d\r\n%T Replaced by the time ( %H : %M : %S )<\/pre>\n
As we can see same command is being repeated number of times in above output. How to filter simple or non destructive commands in history?. Use the following \u2018export<\/strong>\u2018 command by specifying command in\u00a0HISTIGNORE=\u2019ls -l:pwd:date:\u2019<\/strong>\u00a0will not saved by system and not be shown in history command.<\/p>\n
[narad@tecmint ~]$ export HISTIGNORE='ls -l:pwd:date:'<\/pre>\n
4. Ignore Duplicate Commands in History<\/h3>\n
With the below command will help us to ignore duplicate commands entry made by user. Only single entry will be shown in history, if a user execute a same command multiple times in a Bash Prompt.<\/p>\n
[narad@tecmint ~]$ export HISTCONTROL=ignoredups<\/pre>\n
5. Unset export Command<\/h3>\n
Unset export command on the fly. Execute\u00a0unset export<\/b>\u00a0command with variable one by one whatever commands have been exported by\u00a0export<\/b>\u00a0command.<\/p>\n
[narad@tecmint ~]$ unset export HISTCONTROL<\/pre>\n
6. Save export Command Permanently<\/h3>\n
Make an entry as follows in\u00a0.bash_profile<\/b>\u00a0to save\u00a0export<\/b>\u00a0command permanently.<\/p>\n
[narad@tecmint ~]$ vi .bash_profile\r\n\r\n# .bash_profile\r\n\r\n# Get the aliases and functions\r\nif [ -f ~\/.bashrc ]; then\r\n        . ~\/.bashrc\r\nfi\r\n\r\n# User specific environment and startup programs\r\n\r\nexport HISTCONTROL=ignoredups<\/b>\r\n\r\nPATH=$PATH:$HOME\/bin\r\nexport PATH<\/pre>\n
7. List Specific User\u2019s Executed Commands<\/h3>\n
How to see command history executed by a specific user. Bash keeps records of history in a\u00a0\u2018~\/.bash_history\u2019<\/b>file. We can view or open file to see the command history.<\/p>\n
[narad@tecmint ~]$ vi .bash_history\r\n\r\ncd \/tmp\/\r\ncd logstalgia-1.0.3\/\r\n.\/configure\r\nsudo passwd root\r\napt-get install libsdl1.2-dev libsdl-image1.2-dev libpcre3-dev libftgl-dev libpng12-dev libjpeg62-dev make gcc\r\n.\/configure\r\nmake\r\napt-get install libsdl1.2-dev libsdl-image1.2-dev libpcre3-dev libftgl-dev libpng12-dev libjpeg62-dev make gcc++\r\napt-get install libsdl1.2-dev libsdl-image1.2-dev libpcre3-dev libftgl-dev libpng12-dev libjpeg62-dev make gcc\r\napt-get install make\r\nmysql -u root -p\r\napt-get install grsync\r\napt-get install unison\r\nunison<\/pre>\n
8. Disable Storing History of Commands<\/h3>\n
Some organization do not keep history of commands because of security policy of the organization. In this case, we can edit\u00a0.bash_profile<\/b>\u00a0file (It\u2019s hidden file) of user\u2019s and make an entry as below.<\/p>\n
[narad@tecmint ~]$ vi .bash_profile\r\n\r\n# .bash_profile\r\n\r\n# Get the aliases and functions\r\nif [ -f ~\/.bashrc ]; then\r\n        . ~\/.bashrc\r\nfi\r\n\r\n# User specific environment and startup programs\r\n\r\nPATH=$PATH:$HOME\/bin\r\nHISTSIZE=0\r\nexport PATH\r\n.bash_profile (END)<\/pre>\n
Save file and load changes with below command.<\/p>\n
[narad@tecmint ~]$ source .bash_profile<\/pre>\n
Note:<\/b>\u00a0If you don\u2019t want system to remember the commands that you have typed, simply execute below command which will disable or stop recording history on the fly.<\/p>\n
[narad@tecmint ~]$ export HISTSIZE=0<\/pre>\n
Tips:<\/strong>\u00a0Search \u2018HISTSIZE<\/strong>\u2018 and edit in \u2018\/etc\/profile\u2019<\/strong>\u00a0file with superuser. The change in file will effect globally.<\/p>\n
9. Delete or Clear History of Commands<\/h3>\n
With\u00a0up<\/strong>\u00a0and\u00a0down<\/strong>\u00a0arrow, we can see previously used command which may be helpful or may irate you. Deleting or clearing all the entries from bash history list with \u2018-c<\/strong>\u2018 options.<\/p>\n
[narad@tecmint ~]$ history -c<\/pre>\n
10. Search Commands in History Using Grep Command<\/h3>\n
Search command through \u2018.bash_history<\/strong>\u2018 by piping your history file into \u2018grep<\/strong>\u2018 as below. For example, the below command will search and find \u2018pwd<\/strong>\u2018 command from the history list.<\/p>\n
[narad@tecmint ~]$ history | grep pwd\r\n\r\n  113  2013-06-09 10:40:12     pwd\r\n  141  2013-06-09 10:40:12     pwd\r\n  198  2013-06-09 15:46:23     history | grep pwd\r\n  202  2013-06-09 15:47:39     history | grep pwd<\/pre>\n
11. Search Lastly Executed Command<\/h3>\n
Search previously executed command with\u00a0\u2018Ctrl+r\u2019<\/b>\u00a0command. Once you\u2019ve found the command you\u2019re looking for, press \u2018Enter<\/strong>\u2018 to execute the same else press \u2018esc<\/strong>\u2018 to cancel it.<\/p>\n
(reverse-i-search)`source ': source .bash_profile<\/pre>\n
12. Recall Last Executed Command<\/h3>\n
Recall a previously used specific command. Combination of\u00a0Bang<\/strong>\u00a0and\u00a08<\/strong>\u00a0(!8<\/strong>) command will recall number\u00a08<\/strong>command which you have executed.<\/p>\n
[narad@tecmint ~]$ !8<\/pre>\n
13. Recall Lastly Executed Specific Command<\/h3>\n
Recall previously used command (netstat -np | grep 22<\/strong>) with \u2018!<\/strong>\u2018 and followed by some letters of that particular command.<\/p>\n
[narad@tecmint ~]$ !net\r\nnetstat -np | grep 22\r\n(No info could be read for \"-p\": geteuid()=501 but you should be root.)\r\ntcp        0     68 192.168.50.2:22             192.168.50.1:1857           ESTABLISHED -\r\ntcp        0      0 192.168.50.2:22             192.168.50.1:2516           ESTABLISHED -\r\nunix  2      [ ]         DGRAM                    12284  -                   @\/org\/freedesktop\/hal\/udev_event\r\nunix  3      [ ]         STREAM     CONNECTED     14522  -\r\nunix  2      [ ]         DGRAM                    13622  -\r\nunix  3      [ ]         STREAM     CONNECTED     12250  -                   @\/var\/run\/hald\/dbus-ujAjOMNa0g\r\nunix  3      [ ]         STREAM     CONNECTED     12249  -\r\nunix  3      [ ]         STREAM     CONNECTED     12228  -                   \/var\/run\/dbus\/system_bus_socket\r\nunix  3      [ ]         STREAM     CONNECTED     12227  -<\/pre>\n
We have tried to highlight power of history command. However, this is not end of it. Please share your experience of history command with us through our comment box below.<\/p>\n
Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
We use\u00a0history\u00a0command frequently in our daily routine jobs to check history of command or to get info about command executed by user. In this post, we will see how we can use history command effectively to extract the command which was executed by users in Bash shell. This may be useful for audit purpose or … <\/p>\n
Continue reading “The Power of Linux \u201cHistory Command\u201d in Bash Shell”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-12619","post","type-post","status-publish","format-standard","hentry","category-linux"],"_links":{"self":[{"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/posts\/12619","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/comments?post=12619"}],"version-history":[{"count":1,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/posts\/12619\/revisions"}],"predecessor-version":[{"id":12620,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/posts\/12619\/revisions\/12620"}],"wp:attachment":[{"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/media?parent=12619"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/categories?post=12619"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/tags?post=12619"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}