If you use or administer a Linux machine it can be quite useful to be able to take a look at the history of commands that have been executed on a machine. This can be pretty useful when debugging and issue. I usually use the command history to help me with this.

# history
…
946 rpm -R mutt-1.4.1-11.rhel4.i386.rpm
947 rpm -qR mutt-1.4.1-11.rhel4.i386.rpm
948 sudp rpm -qa | mail
949 sudo rpm -qa | mail
950 sudo rpm -qa | grep mail
951 rpm -qR sendmail-8.13.1-3.2.el4
952 cd scripts/log_parse/
…

This command gives me a straightforward list of the commands executed on this machine by the user I’m currently logged in as. However, sometimes I need a lot more information than just this. I need to know which command was executed at what time. For this I make a small modification to the commands settings, adding the date and time to the information output by the command:

# export HISTTIMEFORMAT=”%F %T “

Now run the history and see the difference:

# history
…
946 2009-07-20 08:12:33 rpm -R mutt-1.4.1-11.rhel4.i386.rpm
947 2009-07-20 08:09:33 rpm -qR mutt-1.4.1-11.rhel4.i386.rpm
948 2009-07-20 09:49:44 sudp rpm -qa | mail
949 2009-07-20 10:37:33 sudo rpm -qa | mail
950 2009-07-20 10:17:13 sudo rpm -qa | grep mail
951 2009-07-20 10:12:23 rpm -qR sendmail-8.13.1-3.2.el4
952 2009-07-20 10:22:43 cd scripts/log_parse/
…

Add this command to your users .bashrc file to make the change permanent.