List command line history with timestamp

October 16th, 2008 mysurface Posted in Common, history, last | Hits: 269436 | 36 Comments »

History is a common command for shell to list out all the executed commands. It is very useful when it comes to investigation on what commands was executed that tear down the server. With the help of last command, you be able to track the login time of particular user as well as the the duration of the time he/she stays login.

mysurface    tty7         :0               Mon Oct  6 20:07 - down   (00:00)
reboot   system boot  Mon Oct  6 20:06          (00:00)
mysurface    pts/8     Mon Oct  6 17:42 - down   (01:58)
mysurface    pts/7        :0.0             Mon Oct  6 17:41 - 19:40  (01:59)
mysurface    pts/6        :0.0             Mon Oct  6 17:27 - 19:40  (02:13)
mysurface    pts/5        :0.0             Mon Oct  6 17:27 - 19:40  (02:13)
mysurface    pts/5        :0.0             Mon Oct  6 15:52 - 15:59  (00:07)

If the command line history could provides the date time of the commands being executed, that may really narrow down the scope of the user actions that cause the server malfunction. By default, history do not append with timestamp, but it is easy to configure it to display timestamp, you just need to set one environment variable HISTTIMEFORMAT.

HISTTIMEFORMAT takes format string of strftime. Check out the strftime manual to choose and construct the timestamp that suit your taste. My favorite is “%F %T “.


Execute history again and you will see the effect on the spot, bare in mind that the timestamp for command lines that executed at previous sessions may not valid, as the time was not tracked.

  994  2008-10-16 02:27:40 exit
  995  2008-10-16 01:12:20 iptables -nL
  996  2008-10-16 01:47:46 vi .bash_profile
  997  2008-10-16 01:47:55 history
  998  2008-10-16 01:48:03 . .bash_profile
  999  2008-10-16 01:48:04 history
 1000  2008-10-16 01:48:09 exit
 1001  2008-10-16 02:27:43 history

I would suggest you to put the export into ~/.bash_profile as well as /root/.bash_profile. In case you do not have .bash_profile, you can choose to put into ~/.bashrc.

Don’t mess up my servers! Your actions will be track!

36 Responses to “List command line history with timestamp”

  1. hope this may help..


  2. Nice and clean website. Lots of useful articles too.

    Thanks for the tips.

  3. This is a very useful information.Thanks a lot

  4. Thanks,
    Very usefull tip. Keep them cuming(oops, :) I mean coming)… lol

  5. Uwe Brauer Says:

    Thanks, but I am using tcsh shell. I googled around
    and there seems to be no easy way in the tcsh shell.

    Somebody has an idea?

    Uwe Brauer

  6. Yes it help me lot, certification.

  7. This only works on BASH 3.0 and up.
    bash –version to find out.

  8. If you use SSH to access the servers, you can set up a forced command which uses “script” to record the SSH session on the server. You can also use “tee” to record sessions from the client end.

    I’ve always wondered why somebody doesn’t just write some code into execve() which logs a copy of the command line for every new process…

  9. nice one

  10. hi
    i have a problem , i need to show only last weeks all the process or command i have run in Linux. i don know how to filter only those commands. i have tried HISTORY command with several options but cannot. please help me to get out of this problem.

  11. If you want the complete time stamps like this:
    1051 : Wed 16 Jun 2010 08:27:30 PM IST : df -h

    then do enter the following in /etc/profile file
    export HISTTIMEFORMAT=”: %c : “

  12. export HISTTIMEFORMAT=”%d %m %T ”

    day month time command

  13. was of great help

  14. Nice info – btw, i like your template, nice.. thanks :)

  15. Thank A Lot………

    Works Great !!!!!!!!

  16. lot of helpful,good work.

  17. testboy2004 Says:

    That’s good stuff. Thank you.

  18. Thanks for the clean and straight information.

  19. here are some more examples like the ones shown above:

    export HISTTIMEFORMAT=”%a %h %d – %r ”
    will display:
    457 Sat Sep 22 – 07:37:28 PM asdsa
    458 Sat Sep 22 – 07:37:29 PM history

    export HISTTIMEFORMAT=”%A %h %d – %r ”
    will display:
    459 Saturday Sep 22 – 07:39:53 PM sdfsad
    460 Saturday Sep 22 – 07:39:54 PM history

    export HISTTIMEFORMAT=”%A %B %d – %r ”
    will display
    459 Saturday September 22 – 07:39:53 PM sdfsad
    460 Saturday September 22 – 07:39:54 PM history

  20. Wholesale Cheap 1:1 replica louis vuitton Handbags / Bags / Purses from china Online Outlet for Sale szvxqk

    Wholesale Cheap 1:1 replica louis vuitton Handbags / Bags / Purses from china Online Outlet for Sale

  21. The general public now can determine what exactly it likes for entertainment, definitely not the major studios and distributors. If you happen to add to that distribution on the web, media, websites online, from gossip to entire movies. This is a totally new world. A lot of it great, some not.

  22. Howdy! This post couldn’t be written any better!

    Going through this article reminds me of my previous roommate!
    He constantly kept preaching about this. I will forward this post to
    him. Fairly certain he will have a great read. Thank you for sharing!

  23. Have you ever considered creating an e-book or guest authoring on other sites?
    I have a blog based upon on the same ideas you discuss
    and would love to have you share some stories/information. I know my readers would appreciate your
    work. If you are even remotely interested, feel free to shoot me an e mail.

  24. Good. Job i.

  25. Good job

  26. Good one job .

  27. Hiii….

    If I’m running HISTTIMEFORMAT=”%F %T ” this command with history command. I got only today’s history. How to find the yesterday & daybefore yesterday’s history along with date & time of the particular day.

    Is it possible????
    If yes, share ur idea plz


  28. The rankings are more impressive, culturally speaking, when broken down into individual categories included in the NEA study. We attend classical concerts, dance performances and nonmusical plays at roughly twice the rate of the country as a whole.
    kappa roma

  29. Say what you will about some very specific and cruel animal testing procedures that are basically banned and don occur now (not all, but many in the above mentioned “league”) or the greed of factory farms. Asians do the same things and then more, more shit for such dubious reasons as “vitality” and “natural medicine”
    manchester united maglie

  30. vegtable garden Do you have a vegtable garden ? what do you grow? whats your favorite?
    la nuova maglia del napoli 2014

  31. Behind this faux rock wall, there a luxury bathroom and private spa. A spacious event room with beautiful 360 degree views of the landscape have hosted some of the poshest parties in the country. In the dining room, there a bar with a fulltime bartender who can create any cocktail known to man and several that haven been discovered yet.?2 New Ways to Lower Cholesterol and The Secret to Relaxing Your Brain
    nuova maglia portogallo

  32. Direct responses to a CMV post must challenge at least one aspect of OP’s stated view (however minor), unless they are asking a clarifying question. Arguments in favor of the view OP is willing to change must be restricted to replies to other comments. [More]
    divisa chelsea

  33. Every year without fail I see the same thing, the day after New Year’s, gyms are packed, weight loss goals have been declared and intentions are eagerly set. But it’s no surprise that weight loss is ranked the No. 1 New Year’s resolution year after year.
    maglia neymar brasile 2014

  34. Chapped or cracked lips are not only visually unappealing, but also terribly uncomfortable. I don often fall victim to it because I use balm every day and every night to prevent it, but sometimes when I am sick and do not drink enough water, my lips can get painfully cracked. Here what I have found to work well:
    maglia argentina bambino

  35. Thus, lenders look to a safety measure known as the debt to equity ratio.
    maglie poco prezzo

  36. Wearing a shirt that some consider sexist does not qualify people to judge him morally.
    numeri maglia milan 2014

Leave a Reply