Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How and Why to Log Your Bash History

spin.atomicobject.com

Post reply on HN
Print view View original

121–130 of 139 posts

Re: How and Why to Log Your Bash History

#121

Post by jchoksi »

I implemented bash audit logging[0] by making use of Ryan Caloras's bash-prexec[1] project which provides a fairly robust and resilient way to implement ZSH's preexec and precmd functionality.

Some of the features of my solution are that it creates a sub folder in the user's home directory called ~/.bash_history and underneath this it will create sub folders for each month (YYYY-MM) and under each of those sub folders will reside a daily audit log file of all the bash command history (YYYY-MM-DD). The audit script logs both login and log outs, as well as each command executed in bash.

---

[0] https://github.com/onelittlehope/bash-prompt [1] https://github.com/rcaloras/bash-preexec

Re: How and Why to Log Your Bash History

#122

Post by aceperry »

"For the last three and a half years, every single command I’ve run from the command line on my MacBook Pro has been logged... the return I’ve gotten on that small investment is immense."

I'm still not sure why it's helpful to have three and a half years of your bash shell logs.

Re: How and Why to Log Your Bash History

#123

Post by glandium »

teamhappy wrote: post #23

I used to do the same thing to figure out which commands I should create short aliases for. Sounded like a good idea at the time but then I realized that I'm creating a file with an awful lot of interesting information in it and I not getting a lot in return. So I set my HISTSIZE to 1000 which is more than enough for interactive shell use and I don't have to worry about having stuff like "youtube-dl fuckmesilly.com/$…

If you don't want one command to end up in your history, type a space before the command.

Re: How and Why to Log Your Bash History

#125

Post by SEJeff »

This entire blog post could be reduced to use the HISTFORMAT variable, which the author doesn't apparently know about. Put this in your ~/.bashrc:

    export HISTTIMEFORMAT='%Y-%m-%d %H:%M.%S | '
An example of the "history | tail" results:

    $ history | tail
    50198  2016-05-31 10:15.57 | cd docker
    50199  2016-05-31 10:16.03 | cd rpms/
    50200  2016-05-31 10:16.11 | scp docker* omniscience:/tmp/
    50201  2016-05-31 10:14.06 | screen -ls
    50202  2016-05-31 08:33.34 | screen -x
    50203  2016-05-31 19:06.53 | grep HIST .bashrc
    50204  2016-05-31 19:07.46 | history | tail
    50205  2016-05-31 19:08.10 | task ls
    50206  2016-05-31 19:08.23 | docker ps -qa
    50207  2016-05-31 19:08.30 | history | tail
A few from my bashrc:

    $ grep HIST .bashrc
    HISTCONTROL=ignoredups:ignorespace
    # for setting history length see HISTSIZE and HISTFILESIZE in bash(1)
    export HISTFILESIZE=99999
    export HISTSIZE=99999
    export HISTTIMEFORMAT='%Y-%m-%d %H:%M.%S | '
    export HISTIGNORE="ls:exit:history:[bf]g:jobs"
And then a cronjob that simply backs up the data.

Re: How and Why to Log Your Bash History

#126

Post by SEJeff »

yomly wrote: post #32

I'm a big fan of saving history - trying to remember all the shell based commands we use is a nightmare! If you're using zsh, a tip I picked up from [0] was to alias all your common commands like 'cd', 'ls' 'fg'... to: ' cd' ' ls' ' fg' ... Then add the following line to your zshrc to ignore lines prepended with a space: setopt HIST_IGNORE_SPACE This keeps your history cleaner from any ls, cd, fg inputs you use. [0]…

So you're saying you just showed me the one feature bash has over zsh!? Bash has an env var named HISTIGNORE that will allow you to not put commonly used boring commands in your history. Mine looks like:

    export HISTIGNORE="ls:exit:history:[bf]g:jobs"

Re: How and Why to Log Your Bash History

#127

Post by SEJeff »

gdulli wrote: post #34

I go one big step further than this and log everything that comes across the screen. One time it saved me from a crontab -r that wiped out a 100+ line crontab. I had viewed it recently so I just copied it out of my history. On a day to day basis it's more about looking up old queries I typed out, the results of those queries at that time, bash commands and their results, the state of a file I edited at a certain time…

install rootsh and set that to your shell. Set the logging directory to something in ~/ with 0600 perms, and away you go!

Re: How and Why to Log Your Bash History

#128

Post by andy_boot »

I like this idea but I know that I have accidentally entered my password or my password with a typo in it on the terminal on at least one occasion.

The only way round this that I can see is to grep out the password - but then my password (or a substring of it) is now in plaintext in my .zshrc/.bashrc

I can't think of a solution to this. Does anyone have anything?

Re: How and Why to Log Your Bash History

#129

Post by reptation »

SEJeff wrote: post #125

This entire blog post could be reduced to use the HISTFORMAT variable, which the author doesn't apparently know about. Put this in your ~/.bashrc: export HISTTIMEFORMAT='%Y-%m-%d %H:%M.%S | ' An example of the "history | tail" results: $ history | tail 50198 2016-05-31 10:15.57 | cd docker 50199 2016-05-31 10:16.03 | cd rpms/ 50200 2016-05-31 10:16.11 | scp docker* omniscience:/tmp/ 50201 2016-05-31 10:14.06 | screen…

the difference is that the author's version backs up every command to a file as it happens. If you have multiple terminals open, you do not get the same output running "history".

Re: How and Why to Log Your Bash History

#130

Post by SEJeff »

reptation wrote: post #129
SEJeff wrote: post #125

This entire blog post could be reduced to use the HISTFORMAT variable, which the author doesn't apparently know about. Put this in your ~/.bashrc: export HISTTIMEFORMAT='%Y-%m-%d %H:%M.%S | ' An example of the "history | tail" results: $ history | tail 50198 2016-05-31 10:15.57 | cd docker 50199 2016-05-31 10:16.03 | cd rpms/ 50200 2016-05-31 10:16.11 | scp docker* omniscience:/tmp/ 50201 2016-05-31 10:14.06 | screen…

the difference is that the author's version backs up every command to a file as it happens. If you have multiple terminals open, you do not get the same output running "history".

something other than:

    shopt -s histappend
Isn't that exactly what that shell option does?
Post reply on HN