{"id":699,"date":"2018-07-25T22:53:47","date_gmt":"2018-07-25T22:53:47","guid":{"rendered":"http:\/\/hyderabadwebhosting.in\/blog\/?p=699"},"modified":"2018-08-01T23:06:50","modified_gmt":"2018-08-01T23:06:50","slug":"the-power-of-linux-history-command-in-bash-shell","status":"publish","type":"post","link":"https:\/\/hyderabadwebhosting.in\/blog\/the-power-of-linux-history-command-in-bash-shell\/","title":{"rendered":"The Power of Linux \u201cHistory Command\u201d in Bash Shell"},"content":{"rendered":"

The Power of Linux \u201cHistory Command\u201d in Bash Shell<\/span><\/em><\/strong><\/p>\n

We use history command frequently in our daily routine jobs to check history of command or to get info about command executed by user. In this post, we will see how we can use history command effectively to extract the command which was executed by users in Bash shell. This may be useful for audit purpose or to find out what command is executed at what date and time.<\/span><\/p>\n

By default date and timestamp won\u2019t be seen while executing history command. However, bash shell provides CLI tools for editing user\u2019s command history. Let\u2019s see some handy tips and tricks and power of history command.<\/span><\/p>\n

1. List Last\/All Executed Commands in Linux<\/span><\/strong><\/p>\n

Executing simple history command from terminal will show you a complete list of last executed commands with line numbers.<\/span><\/p>\n

[root@VPS ~]$ history\r\n1 PS1='\\e[1;35m[\\u@\\h \\w]\\$ \\e[m '\r\n2 PS1=\"\\e[0;32m[\\u@\\h \\W]\\$ \\e[m \"\r\n3 PS1=\"\\u@\\h:\\w [\\j]\\$ \"\r\n4 ping google.com\r\n5 echo $PS1\r\n6 tail -f \/var\/log\/messages\r\n7 tail -f \/var\/log\/messages\r\n8 exit\r\n9 clear\r\n10 history\r\n11 clear\r\n12 history<\/pre>\n
 <\/p>\n
2. List All Commands with Date and Timestamp<\/span><\/strong><\/p>\n
How to find date and timestamp against command? With \u2018export\u2019 command with variable will display history command with corresponding timestamp when the command was executed.<\/span><\/p>\n
 <\/p>\n
[root@VPS ~]$ export HISTTIMEFORMAT='%F %T '\r\n1 2018-06-09 10:40:12 cat \/etc\/issue\r\n2 2018-06-09 10:40:12 clear\r\n3 2018-06-09 10:40:12 find \/etc -name *.conf\r\n4 2018-06-09 10:40:12 clear\r\n5 2018-06-09 10:40:12 history\r\n6 2018-06-09 10:40:12 PS1='\\e[1;35m[\\u@\\h \\w]\\$ \\e[m '\r\n7 2018-06-09 10:40:12 PS1=\"\\e[0;32m[\\u@\\h \\W]\\$ \\e[m \"\r\n8 2018-06-09 10:40:12 PS1=\"\\u@\\h:\\w [\\j]\\$ \"\r\n9 2018-06-09 10:40:12 ping google.com\r\n10 2018-06-09 10:40:12 echo $PS1<\/pre>\n
 <\/p>\n
3. Filter Commands in History<\/span><\/strong><\/p>\n
As we can see same command is being repeated number of times in above output. How to filter simple or non destructive commands in history?. Use the following \u2018export\u2018 command by specifying command in HISTIGNORE=\u2019ls -l:pwd:date:\u2019 will not saved by system and not be shown in history command.<\/span><\/p>\n
[root@VPS ~]$ export HISTIGNORE='ls -l:pwd:date:'<\/pre>\n
 <\/p>\n
4. Ignore Duplicate Commands in History<\/span><\/strong><\/p>\n
With the below command will help us to ignore duplicate commands entry made by user. Only single entry will be shown in history, if a user execute a same command multiple times in a Bash Prompt.<\/span><\/p>\n
[root@VPS ~]$ export HISTCONTROL=ignoredups<\/pre>\n
5. Unset export Command<\/span><\/strong><\/p>\n
Unset export command on the fly. Execute unset export command with variable one by one whatever commands have been exported by export command.<\/span><\/p>\n
[root@VPS ~]$ unset export HISTCONTROL<\/pre>\n
 <\/p>\n
6. Save export Command Permanently<\/span><\/strong><\/p>\n
Make an entry as follows in .bash_profile to save export command permanently.<\/span><\/p>\n
[root@VPS ~]$ vi .bash_profile\r\n# .bash_profile\r\n# Get the aliases and functions\r\nif [ -f ~\/.bashrc ]; then\r\n. ~\/.bashrc\r\nfi\r\n# User specific environment and startup programs\r\nexport HISTCONTROL=ignoredups\r\nPATH=$PATH:$HOME\/bin\r\nexport PATH<\/pre>\n
 <\/p>\n
7. List Specific User\u2019s Executed Commands<\/span><\/strong><\/p>\n
How to see command history executed by a specific user. Bash keeps records of history in a \u2018~\/.bash_history\u2019 file. We can view or open file to see the command history.<\/span><\/p>\n
[root@VPS ~]$ vi .bash_history\r\ncd \/tmp\/\r\ncd logstalgia-1.0.3\/\r\n.\/configure\r\nsudo passwd root\r\napt-get install libsdl1.2-dev libsdl-image1.2-dev libpcre3-dev libftgl-dev libpng12-dev libjpeg62-dev make gcc\r\n.\/configure\r\nmake\r\napt-get install libsdl1.2-dev libsdl-image1.2-dev libpcre3-dev libftgl-dev libpng12-dev libjpeg62-dev make gcc++\r\napt-get install libsdl1.2-dev libsdl-image1.2-dev libpcre3-dev libftgl-dev libpng12-dev libjpeg62-dev make gcc\r\napt-get install make\r\nmysql -u root -p\r\napt-get install grsync\r\napt-get install unison\r\n<\/pre>\n
 <\/p>\n
8. Disable Storing History of Commands<\/span><\/strong><\/p>\n
Some organization do not keep history of commands because of security policy of the organization. In this case, we can edit .bash_profile file (It\u2019s hidden file) of user\u2019s and make an entry as below.<\/span><\/p>\n
[root@VPS ~]$ vi .bash_profile\r\n# .bash_profile\r\n# Get the aliases and functions\r\nif [ -f ~\/.bashrc ]; then\r\n. ~\/.bashrc\r\nfi\r\n# User specific environment and startup programs\r\nPATH=$PATH:$HOME\/bin\r\nHISTSIZE=0\r\nexport PATH\r\n.bash_profile (END)<\/pre>\n
 <\/p>\n
Save file and load changes with below command.<\/span><\/p>\n
[root@VPS ~]$ source .bash_profile<\/pre>\n
 <\/p>\n
9. Delete or Clear History of Commands<\/span><\/strong><\/p>\n
With up and down arrow, we can see previously used command which may be helpful or may irate you. Deleting or clearing all the entries from bash history list with \u2018-c\u2018 options.<\/span><\/p>\n
[root@VPS ~]$ history -c<\/pre>\n
 <\/p>\n
10. Search Commands in History Using Grep Command<\/span><\/strong><\/p>\n
Search command through \u2018.bash_history\u2018 by piping your history file into \u2018grep\u2018 as below. For example, the below command will search and find \u2018pwd\u2018 command from the history list.<\/span><\/p>\n
[root@VPS ~]$ history | grep pwd\r\n113 2018-06-09 10:40:12 pwd\r\n141 2018-06-09 10:40:12 pwd\r\n198 2018-06-09 15:46:23 history | grep pwd\r\n202 2018-06-09 15:47:39 history | grep pwd<\/pre>\n
 <\/p>\n
 \t
 \t\t \t\t\"www.pdf24.org\"<\/a> \t\t  <\/span> \t\tSend article as PDF<\/span> \t\t  <\/span> \t\t \t\t \t<\/form> <\/div>","protected":false},"excerpt":{"rendered":"
The Power of Linux \u201cHistory Command\u201d in Bash Shell We use history command frequently in our daily routine jobs to check history of command or to get info about command executed by user. In this post, we will see how we can use history command effectively to extract the command which was executed by users\u2026 Read More »<\/a><\/span><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_eb_attr":"","footnotes":""},"categories":[6],"tags":[],"class_list":["post-699","post","type-post","status-publish","format-standard","hentry","category-vps"],"_links":{"self":[{"href":"https:\/\/hyderabadwebhosting.in\/blog\/wp-json\/wp\/v2\/posts\/699","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hyderabadwebhosting.in\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hyderabadwebhosting.in\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hyderabadwebhosting.in\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/hyderabadwebhosting.in\/blog\/wp-json\/wp\/v2\/comments?post=699"}],"version-history":[{"count":1,"href":"https:\/\/hyderabadwebhosting.in\/blog\/wp-json\/wp\/v2\/posts\/699\/revisions"}],"predecessor-version":[{"id":700,"href":"https:\/\/hyderabadwebhosting.in\/blog\/wp-json\/wp\/v2\/posts\/699\/revisions\/700"}],"wp:attachment":[{"href":"https:\/\/hyderabadwebhosting.in\/blog\/wp-json\/wp\/v2\/media?parent=699"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hyderabadwebhosting.in\/blog\/wp-json\/wp\/v2\/categories?post=699"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hyderabadwebhosting.in\/blog\/wp-json\/wp\/v2\/tags?post=699"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}