My modified search history lines have an asterisk next to them.

I've searched unix.stackexchange.com and stackoverflow.com, but I yearn for a full explanation for the asterisks in my history (other than what the man page says).

Lines listed with a * have been modified.


$ history | tail
11851  ./block_ip.sh '' 'evil probe'
11852  ./block_ip.sh DROP '' 'evil probe

In this example, a shell script had a third argument, but there was no error, and i ran it twice without specifying (DROP/ACCEPT).

The modification was an attempt to blank out this history so that history-expansion would not lead me to the wrong command (again).

I want to know more about this (but I don't know what I don't know).

Please consider both angles of this:

  • how can i use this (for instance can i get that original command if i need it)?
  • how can a bad guy use this (can someone hide their command history this way)?

If a generic answer is too verbose, please note some of my settings:


And this OS info (It is RedHat...but Debian/Fedora/Ubuntu shouldn't very much...should they?):

Linux qwerutyhgfjkd 3.10.0-693.11.1.el7.x86_64 #1 SMP Mon Dec 4 23:52:40 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux

I am using bash as my shell.

  • 1
    The history command is not part of the standard and since your described behavior does not look like a usual behavior, you would need to explain which shell you are using and under which circumstances you observe the behavior. – schily Jun 7 '18 at 9:46
  • 1
    The HISTFILE and SHELLOPTS variables there are fairly good clues as to the shell, although the question really should be edited to make this explicit. – JdeBP Jun 7 '18 at 14:41
  • I am using bash. – WEBjuju Jun 7 '18 at 15:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.