- View history of commands run in terminal
- The Power of Linux “History Command” in Bash Shell
- 1. List Last/All Executed Commands in Linux
- 2. List All Commands with Date and Timestamp
- 3. Filter Commands in History
- 4. Ignore Duplicate Commands in History
- 5. Unset export Command
- 6. Save export Command Permanently
- 7. List Specific User’s Executed Commands
- 8. Disable Storing History of Commands
- 9. Delete or Clear History of Commands
- 10. Search Commands in History Using Grep Command
- 11. Search Lastly Executed Command
- 12. Recall Last Executed Command
- 13. Recall Lastly Executed Specific Command
- 2 Ways to Re-run Last Executed Commands in Linux
- How to Check Linux Commands History by Dates
- View History Last Executed Linux Commands
- Set History Date and Time for Each Command
- View Linux Command History by Date
- Permanently Set History Date and Time for Each Command
View history of commands run in terminal
To clear the history, delete the file and clear the temp history:
rm ~/.bash_history && history -c
The history size defaults to 500 commands. You can, however, increase this by adding a line to your ~/.bashrc file to set the HISTSIZE variable:
This will not take effect immediately, but only to newly started sessions. To apply this, re-source the .bashrc file:
or run HISTSIZE=. in your current session.
By default it only keeps the latest 500 commands though. You can change the number to be kept, but you only have to accidentally start it with the default settings once, and all your older history will be gone.
You can type history on a terminal to view all the previous executed commands.
You can truncate the output to some lines (where 5 is the number of lines):
If do you want to view only commands containing a string (i.e. mv ), you can do this:
You can recall a command by typing ! followed by the entry number.
Let’s say that I have a history like this:
1 ls -la 2 mkdir foo 3 mv bar.txt foo
- To run mkdir foo , you can type !2 .
- To run the last command, you can use !-1 or !!
- To run the penultimate, you can use !-2
If you run a command that fails because it needs root privileges (i.e. touch /etc/foo ), you can use sudo !! to run the last command as root.
- If you type !man you will execute the last command that begins with man
- If do you type !?man? it will execute the last command that contains man (not neccessarily at the line begin)
If do you have a typo in a command, you can fix it this way. Let’s say that I type cat .bash_hi , to replace .bash_hi by .bash_history I only need to type ^hi^history^ .
The Power of Linux “History Command” in Bash Shell
We use history command frequently in our daily routine jobs to check history of command or to get info about command executed by user. In this post, we will see how we can use history command effectively to extract the command which was executed by users in Bash shell. This may be useful for audit purpose or to find out what command is executed at what date and time.
By default date and timestamp won’t be seen while executing history command. However, bash shell provides CLI tools for editing user’s command history. Let’s see some handy tips and tricks and power of history command.
1. List Last/All Executed Commands in Linux
Executing simple history command from terminal will show you a complete list of last executed commands with line numbers.
[[email protected] ~]$ history 1 PS1='\e[1;35m[\[email protected]\h \w]$ \e[m ' 2 PS1 /cdn-cgi/l/email-protection" data-cfemail="4c390c">[email protected]\h \W]$ \e[m " 3 PS1 /cdn-cgi/l/email-protection" data-cfemail="4d380d">[email protected]\h:\w [\j]$ " 4 ping google.com 5 echo $PS1 6 tail -f /var/log/messages 7 tail -f /var/log/messages 8 exit 9 clear 10 history 11 clear 12 history
2. List All Commands with Date and Timestamp
How to find date and timestamp against command? With ‘export’ command with variable will display history command with corresponding timestamp when the command was executed.
[[email protected] ~]$ export HISTTIMEFORMAT='%F %T ' 1 2013-06-09 10:40:12 cat /etc/issue 2 2013-06-09 10:40:12 clear 3 2013-06-09 10:40:12 find /etc -name *.conf 4 2013-06-09 10:40:12 clear 5 2013-06-09 10:40:12 history 6 2013-06-09 10:40:12 PS1='\e[1;35m[\[email protected]\h \w]$ \e[m ' 7 2013-06-09 10:40:12 PS1 /cdn-cgi/l/email-protection" data-cfemail="354075">[email protected]\h \W]$ \e[m " 8 2013-06-09 10:40:12 PS1 /cdn-cgi/l/email-protection" data-cfemail="85f0c5">[email protected]\h:\w [\j]$ " 9 2013-06-09 10:40:12 ping google.com 10 2013-06-09 10:40:12 echo $PS1
Meaning of HISTTIMEFORMAT variables
%F Equivalent to %Y - %m - %d %T Replaced by the time ( %H : %M : %S )
3. Filter Commands in History
As we can see same command is being repeated number of times in above output. How to filter simple or non destructive commands in history?. Use the following ‘export‘ command by specifying command in HISTIGNORE=’ls -l:pwd:date:’ will not saved by system and not be shown in history command.
[[email protected] ~]$ export HISTIGNORE='ls -l:pwd:date:'
4. Ignore Duplicate Commands in History
With the below command will help us to ignore duplicate commands entry made by user. Only single entry will be shown in history, if a user execute a same command multiple times in a Bash Prompt.
[[email protected] ~]$ export HISTCONTROL=ignoredups
5. Unset export Command
Unset export command on the fly. Execute unset export command with variable one by one whatever commands have been exported by export command.
6. Save export Command Permanently
Make an entry as follows in .bash_profile to save export command permanently.
[[email protected] ~]$ vi .bash_profile # .bash_profile # Get the aliases and functions if [ -f ~/.bashrc ]; then . ~/.bashrc fi # User specific environment and startup programs export HISTCONTROL=ignoredups PATH=$PATH:$HOME/bin export PATH
7. List Specific User’s Executed Commands
How to see command history executed by a specific user. Bash keeps records of history in a ‘~/.bash_history’ file. We can view or open file to see the command history.
[[email protected] ~]$ vi .bash_history cd /tmp/ cd logstalgia-1.0.3/ ./configure sudo passwd root apt-get install libsdl1.2-dev libsdl-image1.2-dev libpcre3-dev libftgl-dev libpng12-dev libjpeg62-dev make gcc ./configure make apt-get install libsdl1.2-dev libsdl-image1.2-dev libpcre3-dev libftgl-dev libpng12-dev libjpeg62-dev make gcc++ apt-get install libsdl1.2-dev libsdl-image1.2-dev libpcre3-dev libftgl-dev libpng12-dev libjpeg62-dev make gcc apt-get install make mysql -u root -p apt-get install grsync apt-get install unison unison
8. Disable Storing History of Commands
Some organization do not keep history of commands because of security policy of the organization. In this case, we can edit .bash_profile file (It’s hidden file) of user’s and make an entry as below.
[[email protected] ~]$ vi .bash_profile # .bash_profile # Get the aliases and functions if [ -f ~/.bashrc ]; then . ~/.bashrc fi # User specific environment and startup programs PATH=$PATH:$HOME/bin HISTSIZE=0 export PATH .bash_profile (END)
Save file and load changes with below command.
Note: If you don’t want system to remember the commands that you have typed, simply execute below command which will disable or stop recording history on the fly.
Tips: Search ‘HISTSIZE‘ and edit in ‘/etc/profile’ file with superuser. The change in file will effect globally.
9. Delete or Clear History of Commands
With up and down arrow, we can see previously used command which may be helpful or may irate you. Deleting or clearing all the entries from bash history list with ‘-c‘ options.
10. Search Commands in History Using Grep Command
Search command through ‘.bash_history‘ by piping your history file into ‘grep‘ as below. For example, the below command will search and find ‘pwd‘ command from the history list.
[[email protected] ~]$ history | grep pwd 113 2013-06-09 10:40:12 pwd 141 2013-06-09 10:40:12 pwd 198 2013-06-09 15:46:23 history | grep pwd 202 2013-06-09 15:47:39 history | grep pwd
11. Search Lastly Executed Command
Search previously executed command with ‘Ctrl+r’ command. Once you’ve found the command you’re looking for, press ‘Enter‘ to execute the same else press ‘esc‘ to cancel it.
(reverse-i-search)`source ': source .bash_profile
12. Recall Last Executed Command
Recall a previously used specific command. Combination of Bang and 8 (!8) command will recall number 8 command which you have executed.
13. Recall Lastly Executed Specific Command
Recall previously used command (netstat -np | grep 22) with ‘!‘ and followed by some letters of that particular command.
[[email protected] ~]$ !net netstat -np | grep 22 (No info could be read for "-p": geteuid()=501 but you should be root.) tcp 0 68 192.168.50.2:22 192.168.50.1:1857 ESTABLISHED - tcp 0 0 192.168.50.2:22 192.168.50.1:2516 ESTABLISHED - unix 2 [ ] DGRAM 12284 - @/org/freedesktop/hal/udev_event unix 3 [ ] STREAM CONNECTED 14522 - unix 2 [ ] DGRAM 13622 - unix 3 [ ] STREAM CONNECTED 12250 - @/var/run/hald/dbus-ujAjOMNa0g unix 3 [ ] STREAM CONNECTED 12249 - unix 3 [ ] STREAM CONNECTED 12228 - /var/run/dbus/system_bus_socket unix 3 [ ] STREAM CONNECTED 12227 -
We have tried to highlight power of history command. However, this is not end of it. Please share your experience of history command with us through our comment box below.
2 Ways to Re-run Last Executed Commands in Linux
One of the greatest features of Bash is the command history, which stores all commands a user runs, in a history file within his/her home directory (typically /home/$USER/.bash_history). This allows the user to easily recall, edit and rerun previous commands.
In this article, we will demonstrate how to re-execute a specific command from the history of commands entered to a shell. This is useful to avoid typing the same commands over and over again.
Normally, to get a command you recently run, you can use the Up arrow keys to retrieve a previous command. Pressing it constantly takes you through multiple commands in history, so you can find the one you want. Use the Down arrow to move in the reverse direction.
However, the history file may contain a lot of entries, to re-execute a specific command from the history of commands, you can run the history command.
Then get the number(s) of the command(s) you want to re-execute (if, for example you want to restart PHP-FPM and view its status, you need to re-execute the commands 997 and 998) as shown.
You can also re-execute previously used command (sudo yum update) with ‘!’ character followed by a few of the first characters (for instance sud or sudo) of that particular command as shown.
For more information about Bash history, see these following guides:
That’s all! Bash history is a cool feature that allows you to easily recall, edit and rerun previous commands. If you know other ways to re-excute the last exucuted command do share with us in the comment section.
How to Check Linux Commands History by Dates
The history command in Linux is used to view previously executed commands from the terminal. It will show a list of commands, with an ‘id’ next to each command.
View History Last Executed Linux Commands
The historically run commands are stored in a dedicated file by the Linux shell.
Set History Date and Time for Each Command
The history command also stores the date and time of executing the command, however, does not, by default, show the time of execution of past commands.
To make history show the date as well, we need to set the global variable HISTTIMEFORMAT in the shell to the appropriate format, which can be done using the export command as follows:
$ export HISTTIMEFORMAT='%F %T' $ history
View Linux Command History by Date
Now, you can pipe the above history command output to ‘grep‘ to get a history of commands executed on a particular date.
Similarly, you can also filter the output for multiple key dates.
$ history | grep -E '2021-01-25|2021-01-23'
Using this way, you can specify the dates as patterns for the last ‘N’ days, or some other combination of dates, and thus get command history for all those dates.
For example, to get command history from the last third to last the fifth date, you can use:
$ history | grep -E '2021-01-23|2021-01-22|2021-01-21'
Now, when we export the variable ‘HISTTIMEFORMAT‘ to the shell profile from the command line, it is exported just for the session, i.e., till the time the terminal is running, after which the variable is removed from the shell profile.
Permanently Set History Date and Time for Each Command
To permanently add the variable to the shell profile, add the export statement to your shell profile file (every command from which runs at the start of a shell).
For example, in the case of ‘Bash‘, run the following to export the variable permanently.
$ export HISTTIMEFORMAT='%F %t' >> ~/.bash_profile
If the file .bash_profile exists, the operator ‘>> ‘ will append the export statement to the file, otherwise, it creates the file and writes the statement.
Conclusion
In this article, we have learned how to check the command history of the last few days in Linux. For more information on the history command, make sure you check out its command line manual page by running:
Thanks for reading and let us know your questions or thoughts in the comments below!