Bash – Inconsistent Bash history

bashcommand history

On this Debian Jessie installation, Bash history seems to be behaving inconsistently in Gnome Terminal:

$ echo $USER
me
$ echo $HISTFILE
/home/me/.bash_history
$ grep browser ~/.bash_history 
browser-sync start
$ history | grep browser
 2071  grep browser ~/.bash_history 
 2073  history | grep browser

The browser-sync line from the ~/.bash_history file is quite old: much older than the current Terminal session. Why isn't it showing up in the results from history | grep browser?

Best Answer

By default, ~/.bash_history is written to disk when an interactive session terminates. This means that if you have concurrent shells open, only the most recently terminated shell session has its history written to disk.

(technically, all sessions are written to disk, but two concurrent sessions don't know about the others' histories, so when one exits, it writes what it thinks the new history to be, and then when the other exits, it writes its history)

See https://unix.stackexchange.com/a/1292/20246 for more details.

Related Solutions

Bash – Saving bash history from multiple Konsole not working correctly

I have concluded that it is not possible to append the new commands directly and at the same time to remove any duplicates. So my solution is to run the following command ones in a while. or to put it in my crontab.

tac $HOME/.bash_history | awk '!seen[$0]++' | tac > $HOME/.hist_Temp 
mv $HOME/.hist_Temp $HOME/.bash_history

The above command will keep the last occurrence of a command and remove every other repetitions above it from the history file without messing up the order.

Bash – Shell – Deal with multiple command history files

Shell history files are a poor way of auditing commands. They can trivially be modified or bypassed by users. They are only useful if you trust users not to deliberately or accidentally bypass the auditing mechanism. For example, commands started from a GUI, from an editor, etc. aren't recorded this way. There are many other ways a user could launch non-logged commands and even maintain plausible deniability that they were doing it for convenience or without realizing it and not as a deliberate attempt to bypass a security measure.

If you make the history files append-only (which requires running chattr +a as root on the history file), then everything that's been recorded stays recorded, but it's still easy to bypass the recording.

Rather than keep separate history files, you could keep a single history file and back it up regularly. That will retain the date at which commands were executed, but not the terminal.

If you need to have some confidence that the logs correspond to the commands that were executed, shell history files are the wrong tool. Use the audit daemon instead. Configure it to log all execve calls.

auditctl -A exit,always -S execve

See the following questions for more information:

Best Answer

Related Solutions

Bash – Saving bash history from multiple Konsole not working correctly

Bash – Shell – Deal with multiple command history files

Related Question