historySearch, reuse and clean your command history
history lists the commands you've typed, numbered, so you can search them, re-run them with ! shortcuts or Ctrl+R, and delete lines that should never have been saved, like a password typed on the command line.
history [N] | history -c | history -d OFFSET | history -a | -r | -w ( !! !N !-N !string !$ )You ran a long kubectl command an hour ago and need it again.
historyBash builtin: prints the in-memory history list with line numbers.
In an interactive bash, each line you enter is added to an in-memory list after history expansion (the ! syntax) has been applied. HISTSIZE caps the list in memory, 1000 on Ubuntu. At startup bash loads $HISTFILE (~/.bash_history), trimmed to HISTFILESIZE lines (2000 on Ubuntu). At exit it writes the list back, appending if shopt histappend is on, which Ubuntu enables. So commands from a session reach the file only when that shell exits, and two open terminals each write their own list. HISTCONTROL=ignoreboth (Ubuntu default) skips duplicates of the previous line and lines that start with a space. HISTTIMEFORMAT makes history print and save timestamps. History expansion happens before the line is parsed: !! is the previous command, !N line N, !-N N commands ago, !str the last command starting with str, !$ the last word of the previous command. zsh keeps its own history in ~/.zsh_history with different defaults.
history [N]Show all, or the last N entries!! / !N / !-NRe-run last command / line N / N commands back!stringRe-run the most recent command starting with string!$ / !*Last argument / all arguments of the previous commandCtrl+RIncremental reverse search; Ctrl+R again for older matcheshistory -d NDelete entry N (negative counts from the end)history -cClear the in-memory listhistory -a / -wAppend new lines / write the whole list to HISTFILE nowHISTCONTROL=ignorespaceLines starting with a space aren't savedHISTTIMEFORMAT='%F %T 'Show and save a timestamp per entryTyping passwords and tokens as command argumentsThey're saved in ~/.bash_history and visible in ps to other users while the command runs.
Let the tool prompt (mysql -p, read -s), or read from a 0600 file!rm or !kubectl without lookingIt re-runs the most recent match, which may not be the one you think, with no confirmation.
Ctrl+R to see it first, or !rm:p to print without runningRelying on bash history as an audit logUsers can edit or clear it, it's only written at exit, and it misses commands run by scripts.
auditd, sudo logs (journalctl _COMM=sudo) or session recordinghistory -c to remove a leaked secretIt clears memory only; ~/.bash_history on disk still has the secret.
history -d N && history -w, then rotate the secretTry these on a Linux machine of your own. Each task has a hint and a solution.
The sandbox shell is zsh. Start bash, run three commands, then show only the last 3 history entries.
In bash, find every command in your history that mentions 'log' and re-run one by its number.
In bash, run a command that starts with a space and prove it wasn't recorded.
Turn on timestamps and show the last 5 commands with the time they ran.
historySearch, reuse and clean your command history
history lists the commands you've typed, numbered, so you can search them, re-run them with ! shortcuts or Ctrl+R, and delete lines that should never have been saved, like a password typed on the command line.
history [N] | history -c | history -d OFFSET | history -a | -r | -w ( !! !N !-N !string !$ )You ran a long kubectl command an hour ago and need it again.
historyBash builtin: prints the in-memory history list with line numbers.
In an interactive bash, each line you enter is added to an in-memory list after history expansion (the ! syntax) has been applied. HISTSIZE caps the list in memory, 1000 on Ubuntu. At startup bash loads $HISTFILE (~/.bash_history), trimmed to HISTFILESIZE lines (2000 on Ubuntu). At exit it writes the list back, appending if shopt histappend is on, which Ubuntu enables. So commands from a session reach the file only when that shell exits, and two open terminals each write their own list. HISTCONTROL=ignoreboth (Ubuntu default) skips duplicates of the previous line and lines that start with a space. HISTTIMEFORMAT makes history print and save timestamps. History expansion happens before the line is parsed: !! is the previous command, !N line N, !-N N commands ago, !str the last command starting with str, !$ the last word of the previous command. zsh keeps its own history in ~/.zsh_history with different defaults.
history [N]Show all, or the last N entries!! / !N / !-NRe-run last command / line N / N commands back!stringRe-run the most recent command starting with string!$ / !*Last argument / all arguments of the previous commandCtrl+RIncremental reverse search; Ctrl+R again for older matcheshistory -d NDelete entry N (negative counts from the end)history -cClear the in-memory listhistory -a / -wAppend new lines / write the whole list to HISTFILE nowHISTCONTROL=ignorespaceLines starting with a space aren't savedHISTTIMEFORMAT='%F %T 'Show and save a timestamp per entryTyping passwords and tokens as command argumentsThey're saved in ~/.bash_history and visible in ps to other users while the command runs.
Let the tool prompt (mysql -p, read -s), or read from a 0600 file!rm or !kubectl without lookingIt re-runs the most recent match, which may not be the one you think, with no confirmation.
Ctrl+R to see it first, or !rm:p to print without runningRelying on bash history as an audit logUsers can edit or clear it, it's only written at exit, and it misses commands run by scripts.
auditd, sudo logs (journalctl _COMM=sudo) or session recordinghistory -c to remove a leaked secretIt clears memory only; ~/.bash_history on disk still has the secret.
history -d N && history -w, then rotate the secretTry these on a Linux machine of your own. Each task has a hint and a solution.
The sandbox shell is zsh. Start bash, run three commands, then show only the last 3 history entries.
In bash, find every command in your history that mentions 'log' and re-run one by its number.
In bash, run a command that starts with a space and prove it wasn't recorded.
Turn on timestamps and show the last 5 commands with the time they ran.