Linux history \u2014 the record of commands that you\u2019ve used on the command line \u2014 can simplify repeating commands and provide some very useful information when you\u2019re trying to track down how recent system or account changes might have come about.\nTwo things you need to understand before you begin your sleuthing, however, are that the shell\u2019s command memory can be selective and that dates and times for when commands were run are optional.\nBasic Linux history\nLet\u2019s first look at how dates and times are recorded when commands are entered on the command line. By default, they are not. The history command simply provides a list of previously used commands. That\u2019s all that is saved in the history file. For bash users, this information all gets stuffed into the .bash_history file; for other shells, it might be just .history.\n$ echo $HISTFILE\n\/home\/myuser\/.bash_history\n\nHow much command history is preserved is limited by the HISTSIZE setting if one has been set (usually the case). Most accounts are set up to record 100, 500 or 1,000 commands, and the older commands are overwritten by newer ones when that limit is exceeded.\n$ echo $HISTSIZE\n500\n\nAnother interesting behavior is that commands entered in the current login session are not added to the history file until you log off. Instead, they are written to a history buffer that is added to the history file at the end of the login session.\nAdding dates and times to the history file\nBy default, the history file remembers only the commands themselves, not the dates\/times when they were entered. And nothing you can do will provide information on when the commands were used in the past.\nIf you want to record the dates and times, you can add a command like this to one of the files that is run at login \u2014 like .bash_profile. Afterwards, you can source the file (. ~\/.bash_profile) to make the change active right away or wait to your next login for the change to be effective.\n$ echo export HISTTIMEFORMAT="%m\/%d\/%y %T " >> ~\/.bash_profile\n\nThe format you choose will determine how your command history will be displayed, but not how it will be recorded. Date and time information will be displayed in a format like the "02\/20\/18 09:10:11 " when a setting like that shown above is used. Each portion of the time format stands for a date component.\ny\tyear in 2-digit format\nY\tyear in 4-digit format\nm\tmonth in 2-digit format\nd\tday in 2-digit format\nT\ttime in 24-hour format\n%r\tdate in 12 hour AM\/PM format\n%D\tdate in mm\/dd\/yy format\n\nDon't neglect the blank before the closing quote in your HISTTIMEFORMAT setting, or your dates and commands will run together like this:\n 11 02\/19\/18 21:19:21cat .bash_profile\n 12 02\/19\/18 21:19:27vi .bash_profile\n 13 02\/19\/18 21:20:06echo $HISTCONTROL\n\nOnce you select a date format, dates and times will be added to your history file. However, no dates will be added to records previously added in the file. Instead, once the change is effective, you\u2019ll see dates and times associated with those commands, but they\u2019ll simply reflect the earliest recorded time in the file \u2014 not the dates and times those commands were actually entered.\nIf you change your mind about the date format, no problem. Your command history will display the date\/time information in whatever format is current when you use the history command. This demonstrates that the timestamps stored in the history file are independent of the display format you\u2019ve selected. In fact, the date\/time information will be stored in your history file in this form:\n1519083591\n\n\u201cWhat is that?\u201d you might ask. It\u2019s a display of the time in the infamous Unix "epoch" format \u2014 the number of seconds since the beginning of all things Unix\/Linux. If you want to see some conversions at work, check out this\u00a0epoch converter. If you want to see how these timestamps are stored, dump your history file using the od command, you\u2019ll see lines like this:\n0016440 171 012 043 061 065 061 071 060 070 063 065 071 061 012 157 144\n y n # 1 5 1 9 0 8 3 5 9 1 n o d\n0016460 040 055 142 143 040 056 142 141 163 150 137 150 151 163 164 157\n - b c . b a s h _ h i s t o\n\nNotice that 1519083591 number in there? The converter could tell you that that number stands for Monday, February 19, 2018 11:39:51 PM GMT. Interestingly, this value is not actually stored numerically, but as a series of characters that represent the timestamp (i.e., character 1, character 5 and so on).\nImplementing selective memory\nThere are two ways that selective memory comes into play. For one, you can keep the commands that you\u2019ve entered in the current login session from being added to your history file. Remember that they are not added to that file until you log out. If you clear your session history with history -c before you log out, those commands will be forgotten.\nAnother option is to have the shell ignore commands that start with blanks. In other words, if you type \u201c\u00a0 pwd\u201d instead of \u201cpwd\u201d, the command will not be recorded in your history file. For this feature to be in effect, you need to set your HISTCONTROL setting to \u201cignorespace\u201d.\n$ export HISTCONTROL=ignorespace\n\nOther settings include ignoredups (ignore repeats of a command when entered in succession) and ignoreboth (ignore both commands that begin with spaces and duplicates). To use more than one of these settings, separate them in your HISTCONTROL variable with colons. For example:\n$ export HISTCONTROL=ignorespace:ignoredups\n\nIf you want this setting to be in effect all the time, add the command shown to one of the files (e.g., .bash_profile) that is read when you log in, and check to make sure it is set properly the next time you log in.\n$ echo $HISTCONTROL\nignorespace:ignoredups\n\nWrap-up\nYou can't change history, but you can control how it's recorded \u2014 at least you can on Linux.