View Full Version : Finding out when a command was executed

14th October 2015, 05:53 AM

I am running Fedora 21 workstation -32 Bit. I just realized that there is one way of finding out when a particular command in the commands' history was executed, with the exact date and time, so I did the following as root, but all I see is today's date against each of the commands listed, what am I doing wrong here? Thanks.

[root@localhost john]# export HISTTIMEFORMAT='%F %T '
[root@localhost john]# history
7 2015-10-14 09:34:35 dnf install inxi
8 2015-10-14 09:34:35 dnf install iptable*
.................................................. ........

1001 2015-10-14 10:08:15 rpm -qa|grep -i package
1002 2015-10-14 10:08:48 rpm -qa|grep -i packagekit
1003 2015-10-14 10:14:06 nethogs enp2s0
1004 2015-10-14 10:14:51 history
1005 2015-10-14 10:15:02 export HISTTIMEFORMAT='%F %T '
1006 2015-10-14 10:15:06 history
[root@localhost john]#

14th October 2015, 06:23 AM
Try adding this to root's .bashrc file


Then source it

source /root/.bashrc

After that you should have a better history time format

14th October 2015, 06:40 AM
OK, that was interesting, but I think I have an explanation.

By default, HISTTIMEFORMAT is not set, so when bash writes the history, on exiting, it does not save the time stamps.
When bash starts it reads the history file, truncating it to the number of lines defined by HISTSIZE. These lines are, apparently, given the current time as their time stamp. This is why the time stamps appear to be correct from line 1000 on.

The solution is to set HISTTIMEFORMAT in .bash_profile so that the time stamps are always written.

16th October 2015, 06:40 AM
Friends, thanks a lot.

17th October 2015, 04:01 AM
yes, exactly, if you set HISTTIMEFORMAT in the shell, you have to wait a while for the time stamps show by 'history' to be correct.

What I've frequently seen is I will install a fresh copy of Fedora, then I put in the HISTTIMEFORMAT shell variable and source it but the history list will show all the commands as having the exact same
timestamp. After you use the shell for a while, the command history fills up and you'll then see
correct time values.