Linux History Command

1. Overview

In the Linux system, the <span>history</span> command is a tool used to view the history of commands executed by the current user. It can improve command operation efficiency, facilitate troubleshooting analysis, and enhance auditing capabilities. The Linux Shell (such as Bash) by default records the commands executed by the user and saves them to a history file (such as <span>~/.bash_history</span>). Understanding the principles and usage of <span>history</span> helps us use the terminal more efficiently.

2. Basic Syntax and Options

history [options] [n]

Parameter/Option	Meaning
<span>n</span>	Display the last <span>n</span> historical commands
<span>-c</span>	Clear the current shell’s history
<span>-d offset</span>	Delete the entry with the specified history number
<span>-a</span>	Append the current session’s history to the <span>~/.bash_history</span> file
<span>-r</span>	Read commands from the history file and append them to the current session’s history
<span>-w</span>	Write the current session’s history to the <span>~/.bash_history</span> file
<span>-p</span>	Display commands but do not save them to history
<span>-s</span>	Save the parameters as a command in history

3. History File and Variables

3.1 History File

• The default history file for Bash is:<span>~/.bash_history</span>
• Other shells (such as Zsh) may use <span>~/.zsh_history</span>

3.2 Control Variables

Variable Name	Meaning
<span>HISTSIZE</span>	The number of historical commands saved in the current shell session
<span>HISTFILESIZE</span>	<span>.bash_history</span> file’s maximum record count
<span>HISTFILE</span>	Path to the history file
<span>HISTCONTROL</span>	Control how history is saved
<span>HISTIGNORE</span>	Specify commands not to be recorded in history
<span>HISTTIMEFORMAT</span>	Set the display format for historical timestamps

Example:

export HISTSIZE=2000
export HISTFILESIZE=5000
export HISTCONTROL=ignoredups:ignorespace
export HISTTIMEFORMAT="%F %T "

4. Common Examples

4.1 View Historical Commands

history

4.2 View the Last 10 Commands

history 10

4.3 Re-execute a Command

!998

4.4 Execute the Last Command

!!

4.5 Find and Execute by Keyword

!vim

5. History Management

5.1 Clear History

history -c

5.2 Delete a Specific Entry

history -d 999

5.3 Write to File

history -w

5.4 Read History File

history -r

5.5 Ignore Specific Commands

export HISTIGNORE="ls:pwd:history"

6. Advanced Techniques

6.1 Display History with Timestamps

export HISTTIMEFORMAT="%F %T "

6.2 Real-time Write to History File

PROMPT_COMMAND='history -a'

6.3 Share History Across Multiple Terminals

export PROMPT_COMMAND="history -a; history -n"

6.4 Prevent Sensitive Information from Being Recorded

 echo "mypassword" > pass.txt

7. Analyze Command Usage with grep

history | grep ssh
history | grep docker | wc -l

8. Custom History Features

8.1 Automatic Backup Script for History

#!/bin/bash
backup_dir=~/bash_history_backup
mkdir -p $backup_dir
cp ~/.bash_history $backup_dir/bash_history_$(date +%F_%T).bak

8.2 Command Audit System for History

PROMPT_COMMAND='echo "$(date "+%F %T") $(whoami) $(history 1)" >> /var/log/bash_command_audit.log'

9. Using with the <span>fc</span> Command

fc -l 10 20
fc 1001

10. Real Case Analysis

Case 1: Developer Accidentally Deleted Project Directory

history | grep rm

Case 2: Investigating Malicious Operations

grep 'useradd' ~/.bash_history

11. Differences Between Shell Types

Bash

By default, the <span>history</span> feature is enabled.

Zsh

For example:

setopt SHARE_HISTORY

12. Summary and Recommendations

Recommendation	Description
Set Timestamps	Enhance auditing capabilities
Real-time Writing	Prevent loss of history during sessions
Ignore Sensitive Commands	Improve security
Backup <span>.bash_history</span>	Prevent accidental deletion
Analyze History	Optimize work efficiency

Appendix: Example Configuration for <span>.bashrc</span>

export HISTSIZE=5000
export HISTFILESIZE=10000
export HISTCONTROL=ignoredups:ignorespace
export HISTTIMEFORMAT="%F %T "
export PROMPT_COMMAND="history -a; history -n"

If interested, please follow the public account below!