Skip to main content Skip to navigation

Why are some times in bash history wrong?

Bash is configured to store a timestamp along with commands run, but hasn't always been so. For commands where no timestamp was stored, the date and time at which the current shell session was initiated is displayed.

Example:

[bob@foo ~]$ history | tail -20
  639  2018-12-10 13:51:45 mv form.pl ~/
  640  2018-12-10 13:51:45 rm /data/www/cgi-bin/form.pl 
  641  2018-12-10 13:51:45 ls
  642  2018-12-10 13:51:45 cd /data/www/html/
  643  2018-12-10 13:51:45 ls
  644  2018-12-10 13:51:45 mkdir foo
  645  2018-12-10 13:51:45 cd foo/
  646  2018-12-10 13:51:45 echo "hello world" > index.html
  647  2018-12-10 13:51:45 cp /tmp/htaccess .htaccess
  648  2018-12-10 13:51:45 vim .htaccess 
  649  2018-12-10 12:09:50 echo $PROMPT_COMMAND
  650  2018-12-10 12:09:52 history
  651  2018-12-10 13:50:53 ls
  652  2018-12-10 13:50:58 cd /var/www/html/
  653  2018-12-10 13:51:22 vim index.html
  654  2018-12-10 13:51:33 ls -l
  655  2018-12-10 13:51:35 pd
  656  2018-12-10 13:51:36 pwd
  657  2018-12-10 13:51:49 history | head -20
  658  2018-12-10 13:52:02 history | tail -20
[bob@foo ~]$ 

There's a lot of commands all shown has having been run at 2018-12-10 13:51:45 which is implausible both in the number of them and that they are listed earlier than commands run at earlier times. Those commands were run prior to Bash being configured to store a timestamp. 2018-12-10 13:51:45 is when the current shell session was initiated. This can be seen in the ~/.bash_history file which for the example above looks like this:

mv form.pl ~/
rm /data/www/cgi-bin/form.pl 
ls
cd /data/www/html/
ls
mkdir foo
cd foo/
echo "hello world" > index.html
cp /tmp/htaccess .htaccess
vim .htaccess 
#1544443790
echo $PROMPT_COMMAND
#1544443792
history
#1544449853
ls
#1544449858
cd /var/www/html/
#1544449882
vim index.html
#1544449893
ls -l
#1544449895
pd
#1544449896
pwd
#1544449909
history | head -20
#1544449909
history | head -20
#1544449922
history | tail -20
#1544452535
tail ~/.bash_history
#1544452544
tail -20 ~/.bash_history

The lines starting with # are timestamps in UNIX Epoch time. They can be converted to human readable using the date command. E.g.

$ date -d @1544449895
Mon Dec 10 13:51:35 GMT 2018