Adding timestamps to your bash history


Often we’ve had boxes compromised, or commands run that we have no idea who did it and at what time. Its very frustrating, especially when we have no idea if a customer did it, one of the staff, or if a box was compromised.
Glenn found this little snippet which is now default in all new VPS we have.

HISTTIMEFORMAT="%F-%R%t"

now you can run the following command

 wishes@tulip:~$ history | tail -n 2
 502  2009-10-15-11:26 vim .bashrc
 503  2009-10-15-11:26 history | tail -n 2

If you want this permanent you can put it into /etc/profile on a line by itself. This will then be sites wide.


One response to “Adding timestamps to your bash history”

  1. I’ve always wondered why the history command didn’t include a timestamp. Thanks for the tip!