Hack 50. Display TIMESTAMP in history using HISTTIMEFORMAT

Typically when you type history from command line, it displays the command# and the command. For auditing purpose, it may be beneficial to display the timestamp along with the command as shown below.

# export HISTTIMEFORMAT=’%F %T ‘
# history | more
       1  2008-08-05 19:02:39 service network restart
       2  2008-08-05 19:02:39 exit
       3  2008-08-05 19:02:39 id
       4  2008-08-05 19:02:39 cat /etc/redhat-release

Note: You can also setup the following alias to view the recent history commands.

alias h1='history 10'
alias h2='history 20'
alias h3='history 30'

Comments on this entry are closed.

  • Шляпа January 14, 2010, 7:28 pm

    you mean
    # export HISTTIMEFORMAT=’%F %T ‘

  • anonymous September 22, 2012, 4:47 pm

    Nice, i was looking on how to add AM/PM to the timestamp. While searching i stumbled upon this.. “HISTTIMEFORMAT takes format string of strftime. Check out the strftime manual to choose and construct the timestamp that suit your taste.” on another site. Here is a list of character’s (%a, %A, %b, %B, %c, %C etc.) and what they can do to further modify your HISTTIMEFORMAT:


    here are some more examples like the ones shown above:

    export HISTTIMEFORMAT=”%a %h %d – %r ”
    will display:
    457 Sat Sep 22 – 07:37:28 PM asdsa
    458 Sat Sep 22 – 07:37:29 PM history

    export HISTTIMEFORMAT=”%A %h %d – %r ”
    will display:
    459 Saturday Sep 22 – 07:39:53 PM sdfsad
    460 Saturday Sep 22 – 07:39:54 PM history

    export HISTTIMEFORMAT=”%A %B %d – %r ”
    will display:
    459 Saturday September 22 – 07:39:53 PM sdfsad
    460 Saturday September 22 – 07:39:54 PM history

  • hament singh March 19, 2013, 2:36 pm

    Thanks all of you it is very good note…

  • ANaughtyMice March 30, 2013, 3:18 pm

    (1) Useful examples which are not found elsewhere.
    (2) Maybe you know how to make these date/time history entries appear in “human readable” format in the .bash_history file ??? I have not found the answer to question anywhere !

  • Krisha February 6, 2014, 10:17 pm

    The command is not working properly. It is displaying the date and time of todays for all the commands where as I ran the some command three before.

    How come it is displaying the today date 🙁

  • David Klein March 27, 2014, 12:36 pm

    @Krisha –
    1) add export HISTTIMEFORMAT=’%F %T ‘ to the end of the /etc/bashrc file.
    2) Next, exit your shell and open a new one.
    3) type something like “echo hi”
    4) exit the shell
    5) open a new shell
    6) tail -n 500 ~/.bash_history

    You’ll notice that some of the commands in the history file now have a line #(bunch of numbers) before them… these are there because the environment variable HISTTIMEFORMAT is now set.. before it was not set so those commands get displayed with the current date/time because really.. they have no date/time