Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Basically i want to get a record of all commands executed on my ssh server, with their times. The codes i have tried are :

ssh user@ip 'export HISTFILE=~/.bash_history; set -o history; history'

I got all commands,but i dont get time stamps with this which is expected i guess.

When i first login and then use history command, i get all details including date and time. I would like to get all details when i use history command with ssh. How should i go about it? OH yeah, and if possible i would like to get the history without needing to export HISTFILE.(IF POSSIBLE) Installing packages is not an option.

share|improve this question
    
Without using histfile my command gives no output –  ganducoder May 11 '12 at 12:50
add comment

2 Answers

Two things:

  1. You need to also export e.g.

    HISTTIMEFORMAT='%F %T '
    

    to set display command history times.

  2. If you have not set the HISTTIMEFORMAT environment variable when using a session, the command times will not be saved and you will then of course not be able to see them. By default the current time will be printed as the command time for every command lacking a time indicator.

If you look at the ~/.bash_history file you can see if you have had time stamps activated for the sessions. Every other line will then start with a # followed by the epoch time of the next command.

share|improve this answer
    
yeah thanks. worked like a charm. –  ganducoder May 14 '12 at 10:27
    
1180 05/14/12-15:59:32 #1336971016 1181 05/14/12-15:59:32 ssh root@172.19.66.137 How can i remove the line with #1336971016. it comes after every command @Daniel Andersson –  ganducoder May 14 '12 at 10:32
    
@ganducoder: I can't really see the formatting in the comment field. You could pipe the output to grep -v "^#" to remove all lines that start with a # (if you want to remove a complete line). This is the time stamp field in epoch time, as I described in my post. –  Daniel Andersson May 14 '12 at 10:36
    
lol yeah. grep facepalm. thanks :D –  ganducoder May 14 '12 at 10:41
add comment

If you know the shell to be bash and the history file to be .bash_history a simple fetch should suffice.

scp user@ip:.bash_history .

For the time data,

  • The .bash_history file will carry time information from the history data of all sessions that were running with a HISTTIMEFORMAT configured
  • I think the history update will carry timestamps for the entire session that had a HISTTIMEFORMAT configuration at any time within it
  • Which brings us to a small constraint
    • if you have the bash profile for these remote user logins with the
      export HISTTIMEFORMAT='some format', you are good with just pulling the .bash_history file
    • else, running the remotely history command in any form is not going to get you the time data -- simply because it is not stored (to .bash_history) in the first place; it is lost at the end of each session and only the command list is saved

Hope the last point clarifies feasibility of getting time data.
The good news is, if you can see the time data for past sessions when you login, it is configured and you don't need any change. If not, it is just a matter of inserting the export in the bash profile being used -- no installations required.

ps: I suggest that if your question is focussed on the bash shell, you add that in as a tag.

share|improve this answer
    
yeah its focussed on bash. Sorry forgot to add it –  ganducoder May 14 '12 at 10:05
    
yup exporting works. simple solution. thanks –  ganducoder May 14 '12 at 10:27
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.