Merging Bash SSH Session History
You may have observed once in a while that when you SSH onto a server and you try to look up a command you ran earlier in the "history" output but you do not see it. Linux and Bash provide a very simple solution to merge your history so that all commands you make in all TTY sessions gets consolidated under one history. See how it's done.
Join the DZone community and get the full member experience.Join For Free
You may have observed once in a while that when you SSH onto a server and you try to look up a command you ran earlier (maybe the previous day) in the "history" output but you do not see it. This is because of how an SSH session works! Each time you SSH into a server, it leverages a set of TTY screens to maintain an individual history for that session. So, for example, the first SSH login (for the same userid) may get TTY session #1 while the second SSH login may get TTY session #2, and the server maintains individual session history. So unless, you end up on the same TTY ID the next day (or the next time you log in), the commands you ran on the previous day will not appear on the "history" output.
Linux and Bash (I said 'bash' for reasons mentioned below) provide a very simple solution to merge your history so that all commands you (and many users logging in under the same ID like 'root') make in all TTY sessions gets consolidated under one history. This is *rarely* known to Linux users but can come in very handy during investigations.
This is a great command to know especially when you’re trying to investigate how files went missing on the server. Most likely, a user with 'root' permissions ran a "rm (remove) * -Rf" command not realizing they were removing files under a different directory such as /var or /usr/bin.
# Run the following to merge history -a # Now if you type history, you will now see all of the commands you ran merged under one space history
WARNING: The command may or may not work in your environment. To learn why, read on…
Please note that the "history" command is not a "Linux" command but rather a command offered by the respective shell such as "BASH". And that is why when you run "man history", you get all the commands provided by BASH. In most cases, BASH is the default preferred shell, so when you SSH into a server you may end up in BASH shell. But there are many others such as KORN, ASH, BSH, KSH, ZSH, and so on. Each shell tries to overcome some kind of limitation. So depending upon the shell you’re using, some of the commands such as "history -a" may or may not work accurately. Consult your favorite shells’ man pages to determine how to merge the history.
Today, considering a comment made by my daughter, I thought I’d end all my blogs with a famous quote that inspires me in hopes that others that read my blog daily can also find inspiration and solace in their daily lives.
Now for the quote that has moved me today:
History will judge us by the difference we make in the everyday lives of children.
– Nelson Mandela
[Freedom fighter, Anti-apartheid Revolutionary, President of South Africa]
Published at DZone with permission of Venkatt Guhesan, DZone MVB. See the original article here.
Opinions expressed by DZone contributors are their own.