Hacker News Reader

Comment by nicwolff | Hacker News Reader

This is handy, but if you just want the ability to see when you ran a previous command you can add

    export HISTTIMEFORMAT="%d/%m/%y %T "

to your .bashrc and then

    history

will show the date and time before each command that was run.

View on HN

I'm sure most know this but if anyone thinks this is a way of doing forensics, keep in mind it can be easily skipped over by doing a non-standard logout, like "kill -9 $$" or if a remote ssh connection gets cut for whatever reason. The command history for a session won't get written until logout by default. A workaround such as forcing each entry to be written to a log file will have to be done to have better assurance of true history.

> forcing each entry to be written to a log file

When I last needed it ~2011, there was a small and simple tool called libsnoopy for that.

Emphasis on "log file" though, the "history file" is a different use case, fundamentally unfit for forensics.

I've had this for a while and I noticed at least two problems on my mac:

1) It made the history command run much, much slower (I have HISTSIZE=100000)

2) Dates tend to reset to a uniform but meaningless value. I think it's related to OS reboots.

Excellent point. Seeing when a command in the history list was run is very useful.

My preference is just for a date in the history, rather than date and time. I find that when I'm searching history, date is usually granular enough for me, so I can omit the time and save a little bit of screen real estate.

I had no idea! I was about to try out the linked article, but this is all I really need. Excellent!

I recommend using both approaches together.

With an updating prompt, you can see when a command ran without having to type 'history'.

And adding a date/time stamp to history is very useful when you need to go back further - hours, days or months.

Reply on news.ycombinator.com