How to Display Timestamps in Linux Terminal History Using the HISTTIMEFORMAT Variable

Why Add Timestamps to the Linux History Command?

The Linux history command is an invaluable tool for system administrators and developers. By default, typing history in the terminal outputs a numbered list of the most recent commands executed by the current user. However, this default output lacks one critical piece of context: when the commands were executed.

If you are auditing a server to determine exactly when a configuration file was altered, or if you are trying to retrace your steps to identify when a specific service was restarted, knowing the exact time and date is essential. By configuring the HISTTIMEFORMAT environment variable, you can force the Bash shell to record and display timestamps alongside every command in your history file.

Step 1: Set the HISTTIMEFORMAT Variable Temporarily

Before making permanent changes to your system profile, you can test the timestamp formatting in your current terminal session.

1. Open your Linux terminal.
2. Type the following command and press Enter:

   export HISTTIMEFORMAT="%F %T "

3. Now, type history and press Enter again.

You should now see the date and time listed before each command. The %F format code represents the full date (YYYY-MM-DD), and %T represents the time (HH:MM:SS) in a 24-hour format. Note the trailing space inside the quotation marks; this ensures there is a clear visual separation between the timestamp and the executed command.

Step 2: Understanding the Timestamp Formatting Codes

The HISTTIMEFORMAT variable relies on standard strftime formatting codes. You can customise the output to suit your specific logging requirements.

• %d/%m/%y : Displays the date in DD/MM/YY format (e.g., 25/12/26).
• %Y-%m-%d : Displays the date in YYYY-MM-DD format (identical to %F).
• %H:%M:%S : Displays the time in hours, minutes, and seconds (identical to %T).
• %r : Displays the time in a 12-hour format with AM/PM (e.g., 02:30:15 PM).

For example, if you prefer a more readable format, you could use: export HISTTIMEFORMAT="%d/%m/%y %r "

Step 3: Make the Timestamp Configuration Permanent

Setting the variable using the export command directly in the terminal only applies to the current session. Once you close the terminal or log out, the timestamps will revert to the default setting.

To make the change permanent for your user account, you must add the export command to your Bash profile configuration file.

1. Open your ~/.bashrc file using a text editor such as nano:

   nano ~/.bashrc

2. Scroll to the very bottom of the file using the arrow keys.
3. Paste your preferred export command on a new line:

   export HISTTIMEFORMAT="%F %T "

4. Save the file and exit the editor (in nano, press Ctrl + O, press Enter, then press Ctrl + X).
5. To apply the changes immediately without restarting the terminal, reload the ~/.bashrc file using the source command:

   source ~/.bashrc

Important Limitations to Consider

When you enable HISTTIMEFORMAT, Bash begins recording the timestamp for new commands in the ~/.bash_history file. It cannot retroactively determine when older commands were executed. Any commands executed before you configured the variable will be assigned the exact timestamp of when the variable was activated. Only commands executed after the configuration will feature accurate timestamps.