History Time Format
Did you ever had a look at you bash history?
No? Well, try it issuing the following command:
root@moveaway: history
... 996 netstat -tapn 997 vi /etc/my.cnf 998 vi /etc/my.cnf 999 service mysql restart 1000 service mysqld restart 1001 history
Wow! One thousand (and one) commands issued on my laptop command line! Nice, insn’t it?
Well, ohhhh yess…but…mmm…when did I issue each command?
The default behaviour for the bash history file (.bash_history in your home directory), is to take note only of the commands, nothing else, as you can see “catting” the raw file:
root@moveaway: cat .bash_history .. netstat -tapn vi /etc/my.cnf vi /etc/my.cnf service mysql restart service mysqld restart
Not that useful if you are trying to link some correlations from the commands you issued and what happened in your system. Better for you to timestamp you history log.
How to do it?
First, let’s pay attention to what
root@moveaway: man bash
tells us:
HISTTIMEFORMAT
If this variable is set and not null, its value is used as a format string for strftime(3) to print the time stamp associated with each his-
tory entry displayed by the history builtin. If this variable is set, time stamps are written to the history file so they may be preserved
across shell sessions.
So, setting the variable
HISTTIMEFORMAT
would give a relief to our concern. The syntax is similar the one you use for the command
date
so
man date
will help you to find a proper format string for this variable. Anyway, if you have no idea, here is a pre formatted variable (Year-Month-Day Hours:Minutes:Seconds)
HISTTIMEFORMAT="%Y-%m-%d %H:%M:%S "
This string alone won’t work, we have to “export” it as a environment variable:
export HISTTIMEFORMAT="%Y-%m-%d %H:%M:%S "
Mmm…let’s have a look to our history:
root@moveaway: history
997 2008-07-31 19:40:34 vi /etc/my.cnf 998 2008-07-31 19:40:34 vi /etc/my.cnf 999 2008-07-31 19:40:34 service mysql restart 1000 2008-07-31 19:40:34 service mysqld restart 1001 2008-07-31 19:40:37 history
Ouch! All the entries have the same date stamp! Well, to fix this we should exit the login session and logon again, but our environment variable would get lost. We must make it lasting through sessions. Let’s invoke the
man bash
command again:
When bash is invoked as an interactive login shell, or as a non-interactive shell with the –login option, it first reads and executes commands from
the file /etc/profile, if that file exists. After reading that file, it looks for ~/.bash_profile, ~/.bash_login, and ~/.profile, in that order,
and reads and executes commands from the first one that exists and is readable.
Interesting. It’s time to edit the
/etc/profile
file and write the command in, to make it last:
export HISTTIMEFORMAT="%Y-%m-%d %H:%M:%S "
Save the file, exit the login session and logon again. Now issue some commands…
root@moveaway: prova_time_stamp_1 -bash: prova_time_stamp_1: command not found root@moveaway: prova_time_stamp_2 -bash: prova_time_stamp_2: command not found root@moveaway: prova_time_stamp_3 -bash: prova_time_stamp_3: command not found root@moveaway: history
Well, not real commands, but they will be a good placeholder to mark the timestamps. Let’s issue
history
again:
1001 2008-07-31 19:42:46 prova_time_stamp_1 1002 2008-07-31 19:42:54 prova_time_stamp_2 1003 2008-07-31 19:43:00 prova_time_stamp_3 1004 2008-07-31 19:43:25 history
It works! Now our history is marked with a time stamp for each entry, so it will be easier to understand when a command has been issued. Let’s have a look to the
.bash_history
file, but since the file is fully written only after the login session is closed, logoff, logon again and then issue:
root@moveaway: cat .bash_history ... #1217533366 prova_time_stamp_1 #1217533374 prova_time_stamp_2 #1217533366 prova_time_stamp_3 #1217533405 history
What’s that? Each command is prefixed by a Unix Timestamp, which is converted for you by the
history
command, otherwise you can use an online converter.
Good, isn’t it?
2 Cent Tip:
If you want your history file to take note of more than the standard 500 commands, put in the
profile
the following string:
export HISTSIZE=1000
You will have a 1000 commands worth history file.
Second 2 Cent Tip:
If you want more infos on the time syntax for
HISTTIMEFORMAT
have a look to
man 3 strftime