Command Line Tricks: How To Identify Date and Time of a Unix Command Execution

by Ramesh Natarajan on October 2, 2009

Question: How do I find out what time I executed a command previously on Unix OS? The history command doesn’t display timestamp.

Answer: Set HISTTIMEFORMAT as shown below. Please note that there is a space before the last single-quotes.

$ export HISTTIMEFORMAT='%F %T '

After the above setting, history command will display timestamp in front of all commands. You can also search the history as shown below.

$ history | less
search for the required command
  351  2009-09-08 09:53:47 ls -lrt
  352  2009-09-08 09:53:49 cd ..
  353  2009-09-08 09:55:39 wget -mk -w 20 -P top5-1 -N 
  354  2009-09-08 10:00:04 gk
  355  2009-09-08 10:00:07 cd Bash/Wget/
  356  2009-09-08 10:00:07 ls
/wget

Note: For a full list of history command hacks, refer to: Mastering Linux command line history.

How to view the output in other time formats ?

To view all available date formats do the following.

$ man strftime

Based on the definition from strftime, following are few examples of date and time format that you can use in your history command.

To display AM / PM:

$ export HISTTIMEFORMAT='%F %r '

$ history
  351  2009-09-08 09:53:47 PM ls -lrt
  352  2009-09-08 09:53:49 PM cd ..

To display in dd-MON-YY time format:

$ export HISTTIMEFORMAT='%d-%b-%Y %r '

$ history
  351  08-Sep-2009 09:53:47 PM ls -lrt
  352  08-Sep-2009 09:53:49 PM cd ..

To display timezone:

$ export HISTTIMEFORMAT='%d-%b-%Y %r %Z'

$ history
  351  08-Sep-2009 09:53:47 PM PDT ls -lrt
  352  08-Sep-2009 09:53:49 PM PDT cd ..

Linux Sysadmin Course Linux provides several powerful administrative tools and utilities which will help you to manage your systems effectively. If you don’t know what these tools are and how to use them, you could be spending lot of time trying to perform even the basic administrative tasks. The focus of this course is to help you understand system administration tools, which will help you to become an effective Linux system administrator.
Get the Linux Sysadmin Course Now!

If you enjoyed this article, you might also like..

  1. 50 Linux Sysadmin Tutorials
  2. 50 Most Frequently Used Linux Commands (With Examples)
  3. Top 25 Best Linux Performance Monitoring and Debugging Tools
  4. Mommy, I found it! – 15 Practical Linux Find Command Examples
  5. Linux 101 Hacks 2nd Edition eBook Linux 101 Hacks Book

Bash 101 Hacks Book Sed and Awk 101 Hacks Book Nagios Core 3 Book Vim 101 Hacks Book

{ 7 comments… read them below or add one }

1 MihirJ October 2, 2009 at 7:04 am

Awesome ….. but If say some other system Admins have root access and i want to know not only execution time of command but from which IP the command was executed …..?

Regards,
MihirJ

2 Shakes October 9, 2009 at 11:22 am

I have tried this on other *nix variants without sucess. Are there metholodies to make this work in Solaris, HP-UX, Aix, etc?

3 Stephen Kagaruki October 30, 2009 at 2:50 pm

Thanks so much Ramesh, i need something urgently i want to see who loged in and the commands he excuted is this possible?

4 S.RAGHU December 4, 2009 at 2:49 am

To – Stephen Kagaruki
You can set different HISTFILE for each user.

5 Rajesh.Prakash August 19, 2013 at 3:15 am

Hi,
I have accidentally run the rm -rf command in terminal, due to have lost my impotent directory, Please help to recover steps.

6 Krishan February 7, 2014 at 12:16 am

The command is not working properly. It is displaying the date and time of todays where as I ran the command three before.

How come it is displaying the today date :-(

7 KM March 4, 2014 at 1:21 pm

@ Krishnan: It is valid only for the current session. It doesn’t hold good for previous sessions is what I believe.

Leave a Comment

Previous post:

Next post: