I want to be able to review when a command was executed as well as the syntax of the command. I have exported HISTTIMEFORMAT='%F %T ' . I then execute the history command: history | grep "cp /etc" . The result (last ~15 lines) is displayed below. The earliest time/date displayed is my most recent login time/date, not the time/date of when the command was executed. How do I display the time the command was executed?

993 2014-04-17 07:44:32 history > historyApr16.2014
994 2014-04-17 07:44:32 less historyApr16.2014
995 2014-04-17 07:44:32 net ads join -U adm-johnm -S cen-ad1.vlrb.org
996 2014-04-17 07:44:32 ls /etc/samba
997 2014-04-17 07:44:32 less /etc/samba/smbAD.conf
998 2014-04-17 07:44:32 sudo cp /etc/samba/smb.conf /etc/samba/Osmb.conf
999 2014-04-17 07:44:32 logout
1000 2014-04-17 07:46:12 history | grep "cp /etc"
1001 2014-04-17 07:48:37 man history
1002 2014-04-17 07:52:07 man HISTTIMEFORMAT
1003 2014-04-17 07:57:49 export HISTTIMEFORMAT='%d-%b %T '
1004 2014-04-17 07:58:06 history | grep "cp /etc"
1005 2014-04-17 08:00:10 export HISTTIMEFORMAT='%F %T '
1006 2014-04-17 08:00:16 history | grep "cp /etc"

You should add something similar to
to your .bashrc

This will increase the number of commands in your .bashrc.

I suspect your search for was overwritten by the newer history commands.

In looking back at the command history I had displayed, it occurred to me that the behavior I was seeing, no timestamp earlier than today, even for commands that had been executed yesterday, could be due to the fact that I had never set HISTTIMEFORMAT before this morning's session. So I should also add the

export HISTTIMEFORMAT='%F %T '

command to my .bashrc file to ensure that there is always a timestamp format set during a session???

Yes.

On a side note: please do not rely on this for auditing purposes. Unless set read-only by root about any variable used by your shell can he changed by the user. Haven't declared HISTFILE? Then you can set another one or point to /dev/null. Got HISTFILESIZE? Then you just repeat one command long enough to rotate out what you want to hide. And there's other tricks. If you need to store shell history in a way the auditd daemon doesn't cater for and in a way a user can't taint then use a mechanism like 'rootsh' uses as it can dump everything to a log file or better: (remote!) syslog. I thought that was important enough to mention.

1 members found this post helpful.