bhistory, a tool for nobody

Previously I enabled Timestamps in Bash to allow me to know when someone was doing stupid things, such as deleting vixie-cron or truncating databases at midnight, now I have system that backups all of the .bash_history files on my production system and stores them so I can look for stupid behavior, however the logfiles are a little unfriendly to the human eye

example of logfiles go here

This necessitated the creation of a script that would let me view the history file as it was originally viewable with the history command and the timestamps parsed, thus bhistory was created.


import re
import time
import sys
import os.path

try: sys.argv[1]

except: sys.exit("nNo file specified!nUsage:nbhistory <filename>n")

if os.path.isfile(sys.argv[1]):
        # file exists!
        print ""
        sys.exit("nfile doesn't exist, try againn")

with open(sys.argv[1]) as input_file:
        for i, line in enumerate(input_file):
                #print line,
                m_obj ="^#",line)
                if m_obj:
                        new = line.strip('#')
                        print time.strftime("%Y-%m-%d %H:%M:%S", time.localtime(int(new)))
                else :
                        print line
print "{0}line(s) printed".format(i+1)

Simple chmod the file, call it bhistory or whatever else you please and then drop it somewhere that your path statement covers and its time to view that logfile (and hopefully not find stupid things happening)

Usage: # bhistory /home/somebody/.bash_history

Naturally nobody should consider this a script that I support in any way, use this mess of code at your own discretion just make sure you have the timestamps enabled or not much is going to happen when you use it.

For whatever reason by default bash doesn’t add timestamps to bash.history, so here is how to make that happen.

Add the following line to /etc/bashrc

export HISTTIMEFORMAT="%d/%m/%y %T "

and now when you use the history command you get nice clean timestamps, just keep in mind this is not retroactive so it will only work going forward.  If you have just done this you might need to back out of your current session log back in or create another term window before it will start showing in the new format.

552 11/11/12 17:22:27 vi bashrc
553 11/11/12 17:22:27 man history
554 11/11/12 17:22:27 help history