Time Stamps in BASH HISTORY

By default, History logs the time when you ran a command, but doesn’t display it. The reason for this is when you run the History command, it looks for an environment variable called HISTTIMEFORMAT, which tells it how to format time. If the value is null or not set, then by default it doesn’t show any time.

But that’s not all. Since the HISTTIMEFORMAT takes strftime values, you can do all sorts of magical things. But for what you want to do, the following works.

for more info about strftime :-
http://pubs.opengroup.org/onlinepubs/009695399/functions/strftime.html

Defining the environment variable as follows:

Apply History time stamp for logged in user :-

$ echo ‘export HISTTIMEFORMAT=”%d/%m/%y %T “‘ >> ~/.bash_profile
Where,
%d – Day
%m – Month
%y – Year
%T – Time

Apply for all users :-

$ echo ‘export HISTTIMEFORMAT=”%d/%m/%y %T “‘ >> /etc/profile

modify if needed /etc/profile
HISTCONTROL=ignoreboth
HISTFILE=/home/cadrian/.bash_history
HISTFILESIZE=1000000000
HISTSIZE=10000000

Apply History size :-

$ echo ‘export HISTSIZE=10000’ >> ~/.bash_profile

for more info :-
$ man bash
$ help history
$man 3 strftime

 Make sure all terminals save history
shopt -s histappend histreedit histverify
shopt -s no_empty_cmd_completion # bash>=2.04 only

Whenever displaying the prompt, write the previous line to disk:
PROMPT_COMMAND=’history -a’

Use GREP color features by default: This will highlight the matched words / regexes
export GREP_OPTIONS=’–color=auto’
export GREP_COLOR=’1;37;41′

 

Find history by date :-
$ history --include-date | grep "2015-07-27"

===============================================

Collect the history of particular user every day and send an email.

export HISTTIMEFORMAT to track time stamp in history command
$ echo ‘export HISTTIMEFORMAT=”%d/%m/%y %T “‘ >> ~/.bash_profile

Script :-
userHistory.sh

#!/bin/bash
#This script sends email of particular user
history >/tmp/history
if [ -s /tmp/history ]
then
       mailx -s "history `%d/%m/%y %T`"  </tmp/history
           fi
rm /tmp/history
#END OF THE SCRIPT