Bash history mysteriously wiped?

Questions about applications and software
Forum rules
Before you post please read how to get help
Post Reply
User avatar
megosdog
Level 1
Level 1
Posts: 7
Joined: Thu Jan 11, 2018 4:07 am
Location: Michigan
Contact:

Bash history mysteriously wiped?

Post by megosdog » Fri Mar 02, 2018 7:39 pm

Okay, I've got an honestly weird one that has never happened to me, and I just noticed that it happened. Anyhow, I'm one who never wipes his bash history. There's too many useful commands in there to do that. Anyhow, apparently several days ago my entire bash history got zeroed out. It appears to have been zeroed out sometime between my backups in the 24th of February and the 25th. The thing is, I didn't do it. So my only two thoughts are, someone somehow got into my system and did something, then wiped bash history to cover their tracks, or a recent update that pushed around the 24th or 25th did that. Since I see nothing else on my computer to make me think that I got hacked, so I'm wondering what could have deleted my bash history and why? I only ask because it seems so out of character for an update or something else to just completely purge the file like that unless it was someone covering their tracks. Anyone got any ideas?
Last edited by Moem on Sat Mar 03, 2018 11:14 am, edited 1 time in total.
Reason: Distracting typo is distracting.

MrEen
Level 5
Level 5
Posts: 668
Joined: Mon Jun 12, 2017 8:39 pm

Re: Bash histery mysteriously whipped?

Post by MrEen » Fri Mar 02, 2018 8:17 pm

I'm venturing into unfamiliar territory here, so I may be way off base, but:

Did you possibly play around a bit with your .bashrc file back then? Open the file with xed ~/.bashrc (replace xed with your text editor.) Find the lines that should look like this:
# append to the history file, don't overwrite it
shopt -s histappend

If that second line is commented out, that might explain what happened.

User avatar
all41
Level 12
Level 12
Posts: 4163
Joined: Tue Dec 31, 2013 9:12 am
Location: Computer, Car, Cage

Re: Bash histery mysteriously whipped?

Post by all41 » Sat Mar 03, 2018 12:37 am

Is it possible you have created or logged in as a different user?
Proud to be a supporter and monthly contributor to Mint.

User avatar
megosdog
Level 1
Level 1
Posts: 7
Joined: Thu Jan 11, 2018 4:07 am
Location: Michigan
Contact:

Re: Bash histery mysteriously whipped?

Post by megosdog » Sat Mar 03, 2018 1:13 am

MrEen: Haven't touched that since way back in August when I did my latest system install. My current bashrc looks like this:

Code: Select all

alias du='du --max-depth=1'
export MOZ_DISABLE_PANGO=1
alias locate='locate -i'
DEFAULT=$PS1
PS1="\[\033[1;31m\]\u@Desktop: \w\$\[\033[00m\] "
It'd been compiling bash_history entries right up until the 25th when it was wiped to zero. It's totally weird. I never touched the file at all. That's what's so baffling.

all41: Nope, same user as always. It's like everything in the file just went away and I don't know why. The only change I can think of around that time was that I was doing regular updates via the update manager.

User avatar
all41
Level 12
Level 12
Posts: 4163
Joined: Tue Dec 31, 2013 9:12 am
Location: Computer, Car, Cage

Re: Bash histery mysteriously whipped?

Post by all41 » Sat Mar 03, 2018 1:34 am

just a thought
does ~/.bash_history/Properties/Permissions show you as owner and group with read/write priveleges?
Proud to be a supporter and monthly contributor to Mint.

Mute Ant
Level 13
Level 13
Posts: 4780
Joined: Tue Sep 03, 2013 7:45 pm

Re: Bash histery mysteriously whipped?

Post by Mute Ant » Sat Mar 03, 2018 9:56 am

"Bash histery mysteriously whipped?" Really? I shall set Special Agent Nomko to work on it...
Image
In Chapter One, Boron slays the entire Marketing Department by explaining Asynchronous Protocols.

User avatar
phd21
Level 16
Level 16
Posts: 6196
Joined: Thu Jan 09, 2014 9:42 pm
Location: Florida

Re: Bash history mysteriously wiped?

Post by phd21 » Sat Mar 03, 2018 1:56 pm

Hi megosdog,

I just read your post and the good replies to it. Here are my thoughts on this as well.

Did you run any cleaning or space cleaning utilities, is your drive almost out of space, etc...?

FYI: Came across this great article on using bash history.

How To Use History Command Effectively In Linux | 2daygeek.com
https://www.2daygeek.com/how-to-use-his ... in-linux/#

You might be able to restore the bash history from a backup ...
Phd21: Mint KDE 17.3 & 18.3, 64-bit Awesome OS, Ancient Dell OptiPlex 780 Core2Duo E8400 3GHz,4gb Ram,256gb SDD, Video: Intel 4 Graphics, DVD Lightscribe. Why I use KDE?:https://opensource.com/life/15/4/9-reasons-to-use-kde

lmuserx4849
Level 5
Level 5
Posts: 748
Joined: Wed Dec 17, 2014 2:55 am

Re: Bash histery mysteriously whipped?

Post by lmuserx4849 » Sat Mar 03, 2018 11:31 pm

declare -p ${!HI@} PROMPT_COMMAND;shopt -p | grep hist

Take a look at the output from the above command.
You should see, output like:

export PROMPT_COMMAND='history -a;history -r'
shopt -s histappend

Beside something external, those are the options that would impact history. If you are using multiple terminals/tabs, double check $PROMPT_COMMAND.

User avatar
Arch_Enemy
Level 6
Level 6
Posts: 1080
Joined: Tue Apr 26, 2016 3:28 pm

Re: Bash history mysteriously wiped?

Post by Arch_Enemy » Sun Mar 04, 2018 12:39 am

Places...
Recent Documents...
Clear Recent Documents...
?

Also clears your BASH history...
I have travelled 35629424162.9 miles in my lifetime

One thing I would suggest, create a partition a ~28G partition as /. Partition the rest as /Home.
When the system fails, reinstall and use the exact same username and all your 'stuff' comes back to you.

User avatar
megosdog
Level 1
Level 1
Posts: 7
Joined: Thu Jan 11, 2018 4:07 am
Location: Michigan
Contact:

Re: Bash history mysteriously wiped?

Post by megosdog » Sun Mar 04, 2018 11:47 am

all41, I'm owner and group has zero perms.

phd21, nope. no cleaner scripts and its got tons of space. As for restoring it from backup, that I have. I run a daily snapshot backup to my secondary drive. It's just that I've never had bash history wiped before. So I'm just trying to figure out if it was caused by something the system did, or if I need to look deeper. IE, like a hack or something. So far it's looking a lot like something the system did, but I'm not able to nail down just what. Honestly I'm more worried about someone having gotten in and then wiped the history file to cover their tracks. That was my biggest concern. However, so far that doesn't seem to be the case, so I'm just covering all avenues to be completely sure of that. :)

lmuserx4849, here's what I got from your command:
declare -i HISTCMD="32"
declare -- HISTFILE="/home/raiden/.bash_history"
declare -- HISTFILESIZE="500"
declare -- HISTSIZE="500"
bash: declare: PROMPT_COMMAND: not found
shopt -s cmdhist
shopt -u histappend
shopt -u histreedit
shopt -u histverify
shopt -u lithist

Thanks everyone for helping me track this down, and thanks to whoever fixed my post title too! lol

zimou13
Level 1
Level 1
Posts: 11
Joined: Fri Mar 02, 2018 1:48 pm

Re: Bash history mysteriously wiped?

Post by zimou13 » Sun Mar 04, 2018 12:35 pm

The maximum number of lines contained in the history file. When this variable is assigned a value, the history file is truncated, if neces‐ sary, by removing the oldest entries, to contain no more than that number of lines. The default value is 500. The history file is also truncated to this size after writing it when an interactive shell exits.
Last edited by Moem on Tue Mar 27, 2018 8:58 am, edited 1 time in total.
Reason: Commercial links removed

lmuserx4849
Level 5
Level 5
Posts: 748
Joined: Wed Dec 17, 2014 2:55 am

Re: Bash history mysteriously wiped?

Post by lmuserx4849 » Sun Mar 04, 2018 3:43 pm

Interesting. That doesn't look like the one installed by Linux Mint. When a new user is created /etc/skel/.bashrc is copied to that user's $HOME directory, so you can view that file to see the original content.

At a minimum, try:
HISTSIZE=1000 # in memory
HISTFILESIZE=2000 # on disk
HISTCONTROL="ignoreboth:erasedups"
shopt -s histappend

Consider bumping up HISTFILESIZE and HISTSIZE a lot. Setting them to a negative number makes them unlimited.

Reference: Bash Online Doc or command man bash.

User avatar
megosdog
Level 1
Level 1
Posts: 7
Joined: Thu Jan 11, 2018 4:07 am
Location: Michigan
Contact:

Re: Bash history mysteriously wiped?

Post by megosdog » Thu Mar 08, 2018 12:15 am

Hmm, I've looked everywhere for why this happened, and I can't find anything. So I think at this point, to prevent this in the future, I need to implement "Bash eternal history" on my machine. We use it at work and it's priceless. So I think I'm going to start using it here. That way if this happens again I'll be able to go back and find out why....hopefully. If not, then I'll still be able to recover my bash history. ^_^

Post Reply

Return to “Software & Applications”