The Bash history feature is an invaluable tool which allows users to recall commands previously entered into their shell with relative ease. This makes it easy to enter repeated commands and keep track of what was done on a system. By default, however, a user is unable to see when these commands were actually entered. When auditing a system, it can sometimes be useful to see this type of information, for example when trying to determine how and when a file may have gone missing on the file system. Since Bash version 3, however, you are able to enable time-stamping of entries for review later.
Applicable versions of Bash provide the environment variable HISTTIMEFORMAT which you can set for this purpose. Although it is empty by default, you can simple assign a time format string to enable time-stamping.
The easiest example is as follows:
export HISTTIMEFORMAT="%F %T "
Any new commands entered after this variable is set will be stamped, and the stamps will be accessible when you use the history command.
$ ls
file1 file2 file3
$ date
Mon Oct 20 11:54:37 EDT 2014
$ cal
October 2014
Su Mo Tu We Th Fr Sa
1 2 3 4
5 6 7 8 9 10 11
12 13 14 15 16 17 18
19 20 21 22 23 24 25
26 27 28 29 30 31
$ history
1001 2014-10-20 11:54:08 export HISTTIMEFORMAT="%F %T "
1002 2014-10-20 11:54:28 ls
1003 2014-10-20 11:54:37 date
1004 2014-10-20 11:54:49 cal
1005 2014-10-20 11:55:29 history
$
To make this persistent, you can easily add the export command to your .bashrc file. You can also look at the man pages to get more information on how to craft custom time format strings: man 3 strftime
It's worth noting that once you enable time-stamping, any existing entries in your .bash_history file will automatically get stamped with the current time. This is important because it will not be possible to recover timestamps of commands that were entered before you enabled time-stamping. You must make sure to enable time-stamping before using your shell if you wish to have this information.
