LinuxQuestions.org
Help answer threads with 0 replies.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 04-17-2014, 11:19 AM   #1
UprLftCstr
LQ Newbie
 
Registered: Nov 2013
Posts: 3

Rep: Reputation: Disabled
Question timestamp of command history doesn't show time command was executed?


I want to be able to review when a command was executed as well as the syntax of the command. I have exported HISTTIMEFORMAT='%F %T ' . I then execute the history command: history | grep "cp /etc" . The result (last ~15 lines) is displayed below. The earliest time/date displayed is my most recent login time/date, not the time/date of when the command was executed. How do I display the time the command was executed?

993 2014-04-17 07:44:32 history > historyApr16.2014
994 2014-04-17 07:44:32 less historyApr16.2014
995 2014-04-17 07:44:32 net ads join -U adm-johnm -S cen-ad1.vlrb.org
996 2014-04-17 07:44:32 ls /etc/samba
997 2014-04-17 07:44:32 less /etc/samba/smbAD.conf
998 2014-04-17 07:44:32 sudo cp /etc/samba/smb.conf /etc/samba/Osmb.conf
999 2014-04-17 07:44:32 logout
1000 2014-04-17 07:46:12 history | grep "cp /etc"
1001 2014-04-17 07:48:37 man history
1002 2014-04-17 07:52:07 man HISTTIMEFORMAT
1003 2014-04-17 07:57:49 export HISTTIMEFORMAT='%d-%b %T '
1004 2014-04-17 07:58:06 history | grep "cp /etc"
1005 2014-04-17 08:00:10 export HISTTIMEFORMAT='%F %T '
1006 2014-04-17 08:00:16 history | grep "cp /etc"
 
Old 04-17-2014, 11:41 AM   #2
Habitual
LQ Addict
 
Registered: Jan 2011
Location: Youngstown, Ohio
Distribution: LM17.1/Xfce4.11.8
Posts: 7,667
Blog Entries: 10

Rep: Reputation: 2076Reputation: 2076Reputation: 2076Reputation: 2076Reputation: 2076Reputation: 2076Reputation: 2076Reputation: 2076Reputation: 2076Reputation: 2076Reputation: 2076
You should add something similar to
Code:
HISTSIZE=3000000
HISTFILESIZE=3000000
to your .bashrc

This will increase the number of commands in your .bashrc.

I suspect your search for
PHP Code:
grep "cp /etc" 
was overwritten by the newer history commands.
 
Old 04-17-2014, 11:59 AM   #3
UprLftCstr
LQ Newbie
 
Registered: Nov 2013
Posts: 3

Original Poster
Rep: Reputation: Disabled
Question possible explanation?

In looking back at the command history I had displayed, it occurred to me that the behavior I was seeing, no timestamp earlier than today, even for commands that had been executed yesterday, could be due to the fact that I had never set HISTTIMEFORMAT before this morning's session. So I should also add the

export HISTTIMEFORMAT='%F %T '

command to my .bashrc file to ensure that there is always a timestamp format set during a session???
 
Old 04-17-2014, 01:31 PM   #4
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,332
Blog Entries: 55

Rep: Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533
Quote:
Originally Posted by UprLftCstr View Post
So I should also add the export HISTTIMEFORMAT='%F %T ' command to my .bashrc file to ensure that there is always a timestamp format set during a session???
Yes.

On a side note: please do not rely on this for auditing purposes. Unless set read-only by root about any variable used by your shell can he changed by the user. Haven't declared HISTFILE? Then you can set another one or point to /dev/null. Got HISTFILESIZE? Then you just repeat one command long enough to rotate out what you want to hide. And there's other tricks. If you need to store shell history in a way the auditd daemon doesn't cater for and in a way a user can't taint then use a mechanism like 'rootsh' uses as it can dump everything to a log file or better: (remote!) syslog. I thought that was important enough to mention.
 
1 members found this post helpful.
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
ShellScript executed from command prmpt but not executed from crontab or at command BMMadhav Linux - Newbie 1 11-16-2012 08:20 PM
History with date and executed file/command wetech3 Linux - Newbie 1 02-17-2011 09:04 AM
URGENT! Is there any command to get a history command lines and time in SUSE Linux.? igsoper Linux - Software 5 06-25-2009 03:14 AM
time when a command was executed. anandkj Linux - Newbie 3 12-21-2007 02:09 AM
removing only most previously executed command from history? jagroop mand Linux - Newbie 2 01-19-2005 06:39 AM


All times are GMT -5. The time now is 12:18 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration