This is handy, but if you just want the ability to see when you ran a previous c...

kyuudou · on April 19, 2020

I'm sure most know this but if anyone thinks this is a way of doing forensics, keep in mind it can be easily skipped over by doing a non-standard logout, like "kill -9 $$" or if a remote ssh connection gets cut for whatever reason. The command history for a session won't get written until logout by default. A workaround such as forcing each entry to be written to a log file will have to be done to have better assurance of true history.

kubanczyk · on April 19, 2020

> forcing each entry to be written to a log file

When I last needed it ~2011, there was a small and simple tool called libsnoopy for that.

Emphasis on "log file" though, the "history file" is a different use case, fundamentally unfit for forensics.

blago · on April 19, 2020

I've had this for a while and I noticed at least two problems on my mac:

1) It made the history command run much, much slower (I have HISTSIZE=100000)

2) Dates tend to reset to a uniform but meaningless value. I think it's related to OS reboots.

countermeasure · on April 19, 2020

Excellent point. Seeing when a command in the history list was run is very useful.

My preference is just for a date in the history, rather than date and time. I find that when I'm searching history, date is usually granular enough for me, so I can omit the time and save a little bit of screen real estate.

ansible · on April 19, 2020

I had no idea! I was about to try out the linked article, but this is all I really need. Excellent!

countermeasure · on April 19, 2020

I recommend using both approaches together.

With an updating prompt, you can see when a command ran without having to type 'history'.

And adding a date/time stamp to history is very useful when you need to go back further - hours, days or months.