Is there a way to persist the command history and search it or group it by command?

In other words, I would like to list, say every grep command I have done over the last 3 months. Is that capability possible somehow?

  • In the C shell? Or the Korn shell? Or the Z shell? (-: – JdeBP Mar 10 at 13:15
  • @JdeBP Either bash or C – Tyler Durden Mar 10 at 13:22
  • Added to my answer suggestion for single user – Rui F Ribeiro Mar 12 at 13:30

Assuming you are using bash which is the most common shell


will show you the history that is stored in your .bash_history file. You can increase the size of and add dates in the history by adding


To your .bashrc file. Then you can

history | grep " 2019/0[1-3]"

Note that bash only keeps history for a selection of commands in interactive sessions. If you want to track everything a custom shell wrapper, remote logging, and versioning the whole system are advisable.


To have every command done I would not count on the bash history for several reasons. You can send such commands to the syslog service/daemon.

I used to have a backlog of 1+ year command logs performed in 200+ Debian servers, in a secure central syslog server.

I used a simple "hack" of adding in /etc/bash.bashrc for all users or. bash_profile just for your user the following line:

readonly PROMPT_COMMAND='history -a >(logger -t "cmdline $USER[$PWD] $SSH_TTY $SSH_CONNECTION")'

see related Add BASHPID to history?

  • Given that we're undergoing a GAO audit, I don't don't know that I'd like like to disclose that this information is available. I'd love to see how may staff is handling problems but I don't want the security team to know that my staff's actual commands are available for review. – doneal24 Mar 10 at 16:20
  • @DougO'Neal The problem about using bash history is that is not reliable and not all issued commands will be there for several reasons. I talk about that in that linked U&L answer. When I did that, nobody knew, except my team lead and the IT director. It was very useful to build a case against the incompetence of a supplier and to build a case never to share again root passwords with suppliers. It was also very useful in a compromised server to established a trail of used commands in a compromised account where the command history was deleted. However, I do understand your reservations. – Rui F Ribeiro Mar 10 at 16:23
  • what about bash --noprofile --norc or some random c code? – user1133275 Mar 11 at 13:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.