Command Line History – How to Have Separate Command History for Different Sessions for the Same User

command historycommand linekshtcsh

I face this issue on some of Unix servers. When I open different session for same user, command history is shared by all the session. This creates issues if by mistake I press Ctrl-P or up arrow and just press Enter.
On one occasion I end up running rm -rf * thankfully I was in directory where I don't have permissions to remove files.

How to have separate command history for different sessions for the same user?
Most of the time I am using ksh and tcsh shells.

Best Answer

From the ksh faq:

Q1. How do I get separate history files for shell?

A1. ksh uses a shared history file for all shells that use the same history file name. This means that commands entered in one window will be seen by shells in other windows. To get separate windows, the HISTFILE variable needs to be set to different name before the first history command is created.

Related Solutions

Bash – Programmatically Add Entries to Bash History with Proper Timestamps

I posted this question on the help-bash mailing list and got a response from Chet Ramey, the maintainer of Bash.

He suggested adding either of the following before the history -s command:

set -H    # aka set -o histexpand

histchars='!^#'

I tried each of them and they both work. The reason is that the history comment character which defaults to # hasn't been set at the point that the profile code is running and so is null (\0).

Here's my working file:

HISTTIMEFORMAT='%c : '
histchars='!^#'
set -o history
history -s "# some text as a marker"

Bash – Shell – Deal with multiple command history files

Shell history files are a poor way of auditing commands. They can trivially be modified or bypassed by users. They are only useful if you trust users not to deliberately or accidentally bypass the auditing mechanism. For example, commands started from a GUI, from an editor, etc. aren't recorded this way. There are many other ways a user could launch non-logged commands and even maintain plausible deniability that they were doing it for convenience or without realizing it and not as a deliberate attempt to bypass a security measure.

If you make the history files append-only (which requires running chattr +a as root on the history file), then everything that's been recorded stays recorded, but it's still easy to bypass the recording.

Rather than keep separate history files, you could keep a single history file and back it up regularly. That will retain the date at which commands were executed, but not the terminal.

If you need to have some confidence that the logs correspond to the commands that were executed, shell history files are the wrong tool. Use the audit daemon instead. Configure it to log all execve calls.

auditctl -A exit,always -S execve

See the following questions for more information:

Best Answer

Related Solutions

Bash – Programmatically Add Entries to Bash History with Proper Timestamps

Bash – Shell – Deal with multiple command history files

Related Question