Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to see what a specific linux user on my system did, and I looked at bash_history, but it doesn't have any dates.

Is there a method I can look at that would give me dates/time?

share|improve this question

From what I know, there is (per default) no definite log that associate date/time with each command launched by an user.

However you can try to guess the actions an user did by tallying informations from the command last (which will give you the dates and time when the users logged on the system) with the logs you'll find in /var/log such as syslog.

With chance the command issued some log output in one of the different logs available.

Additionally you can check dates and time of creation/modification of files that you suspect having been affected by the commands you saw in the bash_history, this could give you some more hints on what happened.

share|improve this answer

This would not passively update .bash_history but it would make this task easier in the future.

History timestamps can be done by exporting a variable called HISTTIMEFORMAT you would set it to the format that you would like the timestamp to look like using strftime formatting found by running the command man strftime or here



I would suggest putting this in ~/.bashrc

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .