Timestamps on your bash history

This entry was posted by Thursday, 15 October, 2009
Read the rest of this entry »

Often Iv’ve seen boxes compromised, or commands run that we have no idea who did it and at what time. Its very frustrating, especially when we have no idea if a customer did it, one of the staff, or if a box was compromised.

HISTTIMEFORMAT="%F-%R%t"

now you can run the following command

wishes@tulip:~$ history | tail -n 2
502  2009-10-15-11:26 vim .bashrc
503  2009-10-15-11:26 history | tail -n 2

If you want this permanent you can put it into /etc/profile on a line by itself. This will then be sites wide.


Leave a Reply