1

Is there a way to persist the command history and search it or group it by command?

In other words, I would like to list, say every grep command I have done over the last 3 months. Is that capability possible somehow?

Improve this question
2
  • In the C shell? Or the Korn shell? Or the Z shell? (-: Commented Mar 10, 2019 at 13:15
  • @JdeBP Either bash or C Commented Mar 10, 2019 at 13:22

2 Answers 2

Reset to default
-1

Assuming you are using bash which is the most common shell 

history

will show you the history that is stored in your .bash_history file. You can increase the size of and add dates in the history by adding

HISTSIZE=1000
HISTTIMEFORMAT="%Y/%m/%d %T "

To your .bashrc file. Then you can

history | grep " 2019/0[1-3]"

Note that bash only keeps history for a selection of commands in interactive sessions. If you want to track everything a custom shell wrapper, remote logging, and versioning the whole system are advisable.

Improve this answer
-1

To have every command done I would not count on the bash history for several reasons. You can send such commands to the syslog service/daemon.

I used to have a backlog of 1+ year command logs performed in 200+ Debian servers, in a secure central syslog server.

I used a simple "hack" of adding in /etc/bash.bashrc for all users or. bash_profile just for your user the following line:

readonly PROMPT_COMMAND='history -a >(logger -t "cmdline $USER[$PWD] $SSH_TTY $SSH_CONNECTION")'

see related Add BASHPID to history?

Improve this answer
3
  • Given that we're undergoing a GAO audit, I don't don't know that I'd like like to disclose that this information is available. I'd love to see how may staff is handling problems but I don't want the security team to know that my staff's actual commands are available for review. Commented Mar 10, 2019 at 16:20
  • @DougO'Neal The problem about using bash history is that is not reliable and not all issued commands will be there for several reasons. I talk about that in that linked U&L answer. When I did that, nobody knew, except my team lead and the IT director. It was very useful to build a case against the incompetence of a supplier and to build a case never to share again root passwords with suppliers. It was also very useful in a compromised server to established a trail of used commands in a compromised account where the command history was deleted. However, I do understand your reservations. Commented Mar 10, 2019 at 16:23
  • what about bash --noprofile --norc or some random c code? Commented Mar 11, 2019 at 13:50

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.