One of the first thing I do after installing Linux on a server is setting up the bash history to show the timestamp along with the command issued.

Showing a laconic rm -rf /important_folder command without knowing at what time it was issued is simply useless. I also top up the number of history lines stored (say 10000 is more than ok)…because the command you’re searching for is always out of standard history lines!

On RedHat flavored linux systems all of this is easily done by editing the /etc/profile configuration file as follows:

HISTSIZE=10000
HISTTIMEFORMAT="%F %R"

Note that you have to issue a

source /etc/profile

to make the bash shell aware of the changes on /etc/profile.

The $HISTTIMEFORMAT set above displays a nice timestamp like the one in the following example:

# history | tail -n3  
2330  2012-01-30 18:54 pwd  
2331  2012-01-30 18:54 ls -l  
2332  2012-01-30 18:54 history | tail -n3

Another wise setting would be to put a “locker” on bash history (change its attributes to append only, for example); for this and more tricks, you should give an in-depth read of this valuable article.