How to find out the Time Stamp of the history?
 

As I run command 'history' I got a long list of command history with the command number. But how can I find out the Time Stamp, i.e., at what time a command is executed?

Hi,

Try setting the HISTTIMEFORMAT environment variable first, as follows:

It's probably a good idea to put this in your ~/.bashrc file too.

Regards,

Clifford

Hi,

Sorry. I thought your answer is correct. But as I look the history deeply I found all the command in the history list have the same Time Stamp. For example, I have many commands yesterday. But as call the history now, I see all the command from yesterday or earlier have the same Time Stamp from today.


This is not what I want.

Hi again,

I saw the same thing earlier this week on a different machine, but then got correct timestamps when I tried it on my own machine this morning. Sorry, I should have mentioned that.

I think the variable needs to be set in order for the timestamp data to be collected/saved. That means what you're seeing is entries that weren't saved with a timestamp, and there is no way to see timestamps for such entries.

Setting it in your profile (or system wide in /etc/bash.bashrc) should solve the problem going forward.

I hope this helps.

Regards,

Clifford

Hi again,

You can easily verify whether the timestamps are being saved. They're saved in your ~/.bash_history file with the rest of the info, in the form of comment lines like this:

The numbers like 1408637882 are the timestamps, in seconds since the Unix epoch.

The answer is correct and the report detail is expected.
This is what happens when you first enable history timestamping. It all gets stamped the hour/minute/second that bash re-reads ~/.bash_history.

Successive commands will show a different h:m:s on commands.

This is not partly true. Why? As I call the history today, I got followings:

One can see, some of the earlier commands have the time stamp from today, and some later commands have time stamp from yesterday. This is not logical.

I use RHEL, there is no such file "bash.bashrc". I put the "HISTTIMEFORMAT="%Y-%m-%d %T "" in the ~/.bashrc as you told yesterday. Seems this is not enough?

Yes, I see the numbers (time stamps) in the ~/.bash_history file now. But I find they are not match with that from 'history'. Here is the example. When I open the .bash_history I got:
But as I run the command 'history', I got:


Why?

Hi there,

As far as I know, the shell reads the history from the file when it starts, then keeps track of the history in memory, and only saves it to the file again when you exit.

This means you will see entries in the output from the history command which is not saved in the file yet. It also means you might not see what you expect in the history if multiple sessions use the same history file (which is the default). There's an explanation and possible solution (which I haven't tried) at http://linuxcommando.blogspot.com/20...-multiple.html.

You could also change HISTFILE to unique names if you prefer. This is great if you main goal is to record the history for audit purposes, but usually means you can't pick up your old history from a new session, making it less convenient to use.

Regards,

Clifford

Any part in the chain that provides the audit trail should be trustworthy and any alteration should be impossible. Since in this example the login shell is started by the user and the user can alter quite a few aspects I would disagree as there's absolutely no guarantee of log trail integrity whatsoever. (If you're interested search for posts combining the audit service, 'rootsh' and remote logging.)