Linux · system information

history

what did I type

history prints your recent commands with a number beside each. Any of them can be run again by number, and Ctrl+R searches backwards through them as you type — the fastest way to find a long command from last week.

Ctrl+R, then a few letters, finds a command you ran before. Enter runs it.

List

history

numbered, oldest first

Ctrl+R

type part of the command

Run again

!NUM or !!

!! is the last command

Stored in

~/.bash_history

written when the shell exits

At the terminal

Read the session first, then the notes: each numbered line in the output is answered by the note with the same number.

user@netflow — bashbash

$ history | tail -4

1 501 cd /var/www/site

502 ls -la

503 sudo systemctl restart nginx

504 history | tail -4

2$ !503

sudo systemctl restart nginx

$ apt update

3$ sudo !!

sudo apt update

Illustrative session · names, sizes and dates are examples, and every address is from a documentation or private range

Reading the output

What the numbered lines are telling you

Numbered commands

The most recent are at the bottom. The number is what you use to refer to one.

Running by number

!503 runs command 503 again. The shell prints the command it expanded to before running it.

!! is the previous command

Forgot sudo? "sudo !!" repeats the last command with sudo in front.

Switches

A switch changes how the command behaves. These are the ones used day to day; man history lists the rest. Single-letter switches can usually be joined, so -l -a may be written -la.

NUM: Show only the last NUM commands: history 20.
-c: Clear the history in this shell.
-d NUM: Delete entry number NUM.
-w: Write the current history to the history file now.
-a: Append this session’s new lines to the history file.

Variations worth knowing

The same tool, pointed at a narrower question. These four cover most of what it is reached for day to day.

history | grep ssh

Finds every earlier command that mentioned ssh.

history -c

Clears the history held in this shell’s memory.

history -d 503

Deletes a single entry by number.

export TOKEN=abc123

A leading space keeps a command out of history, where HISTCONTROL is set to ignorespace.

In cybersecurity

Your history is a plain-text record of everything you typed, passwords included.

Secrets end up here

A password given as an argument, or a token in an export, is saved to ~/.bash_history in the clear. It is one of the first files read on a compromised account.

It is a weak audit trail

History is written by the user’s own shell and can be edited or switched off. For real accountability use auditd or sudo’s logging.

A cleared history is a clue

An empty history file, or one linked to /dev/null, on an account that is used daily suggests someone tidied up.

Filed under

System information

Read alongside

manOpens the manual page for a command: what it does, every option, and often examples.aliasDefines a short name for a longer command, and lists the ones already defined.