Bash: Timestamp in bash history

The bash history is a useful thing to remember commands which were entered on a system. But it’s not only useful to help your mind – you can also keep track of the entered commands. This is especially interesting on multi user systems. You are able to check the executed commands after the user logs out. That is extra interesting when you spotted some problems like missing files on a system – you would be able to check if someone removed that file.
But by default you can only track the commands entered and you won’t know when they were entered. This could be very important. Thankfully there is a way to add timestamps to the bash history since Bash version 3.0.

See how to configure your bash to save the timestamp for each command execution…

It is quite easy to configure. You just need to set one environment variable HISTTIMEFORMAT. The HISTTIMEFORMAT variable needs to be added to your bashrc scripts. I prefer to add it to a system wide script rather than a user specific script. So I append the code to  

/etc/bash.bashrc on my Ubuntu system.

export HISTTIMEFORMAT="%F %T "

The HISTTIMEFORMAT uses the format of strftime. You can find the available macros in man 3 strftime or for example here.

After modifying your file start a new shell, type some commands, call history and see the magic:

:> history (...) 501 2009-01-29 21:12:16 history 502 2009-01-29 21:12:54 sudo vi /etc/bash.bashrc 503 2009-01-29 21:13:04 /bin/bash 504 2009-01-29 21:13:11 history

The timestamps are saved directly above each command in the ~/.bash_history file after you exit the shell:

#1233259936 history #1233259974 sudo vi /etc/bash.bashrc #1233259984 /bin/bash #1233259991 history #1233260151 less .bash_history #1233260157 exit

You just made your system a little better to control.

found at: http://larsmichelsen.com/open-source/bash-timestamp-in-bash-history/