Bash history mysteriously wiped?

[megosdog]

Okay, I've got an honestly weird one that has never happened to me, and I just noticed that it happened. Anyhow, I'm one who never wipes his bash history. There's too many useful commands in there to do that. Anyhow, apparently several days ago my entire bash history got zeroed out. It appears to have been zeroed out sometime between my backups in the 24th of February and the 25th. The thing is, I didn't do it. So my only two thoughts are, someone somehow got into my system and did something, then wiped bash history to cover their tracks, or a recent update that pushed around the 24th or 25th did that. Since I see nothing else on my computer to make me think that I got hacked, so I'm wondering what could have deleted my bash history and why? I only ask because it seems so out of character for an update or something else to just completely purge the file like that unless it was someone covering their tracks. Anyone got any ideas?

[MrEen]

I'm venturing into unfamiliar territory here, so I may be way off base, but:

Did you possibly play around a bit with your .bashrc file back then? Open the file with xed ~/.bashrc (replace xed with your text editor.) Find the lines that should look like this:
# append to the history file, don't overwrite it
shopt -s histappend
If that second line is commented out, that might explain what happened.

[all41]

Is it possible you have created or logged in as a different user?

[megosdog]

MrEen: Haven't touched that since way back in August when I did my latest system install. My current bashrc looks like this:

Code: Select all

alias du='du --max-depth=1'
export MOZ_DISABLE_PANGO=1
alias locate='locate -i'
DEFAULT=$PS1
PS1="\[\033[1;31m\]\u@Desktop: \w\$\[\033[00m\] "

It'd been compiling bash_history entries right up until the 25th when it was wiped to zero. It's totally weird. I never touched the file at all. That's what's so baffling.

all41: Nope, same user as always. It's like everything in the file just went away and I don't know why. The only change I can think of around that time was that I was doing regular updates via the update manager.

[all41]

just a thought
does ~/.bash_history/Properties/Permissions show you as owner and group with read/write priveleges?

[Mute Ant]

"Bash histery mysteriously whipped?" Really? I shall set Special Agent Nomko to work on it...

[phd21]

Hi megosdog,

I just read your post and the good replies to it. Here are my thoughts on this as well.

Did you run any cleaning or space cleaning utilities, is your drive almost out of space, etc...?

FYI: Came across this great article on using bash history.

How To Use History Command Effectively In Linux | 2daygeek.com
https://www.2daygeek.com/how-to-use-his ... in-linux/#

You might be able to restore the bash history from a backup ...

[lmuserx4849]

declare -p ${!HI@} PROMPT_COMMAND;shopt -p | grep hist

Take a look at the output from the above command.
You should see, output like:

export PROMPT_COMMAND='history -a;history -r'
shopt -s histappend

Beside something external, those are the options that would impact history. If you are using multiple terminals/tabs, double check $PROMPT_COMMAND.

[Arch_Enemy]

Places...
Recent Documents...
Clear Recent Documents...
?

Also clears your BASH history...

[megosdog]

all41, I'm owner and group has zero perms.

phd21, nope. no cleaner scripts and its got tons of space. As for restoring it from backup, that I have. I run a daily snapshot backup to my secondary drive. It's just that I've never had bash history wiped before. So I'm just trying to figure out if it was caused by something the system did, or if I need to look deeper. IE, like a hack or something. So far it's looking a lot like something the system did, but I'm not able to nail down just what. Honestly I'm more worried about someone having gotten in and then wiped the history file to cover their tracks. That was my biggest concern. However, so far that doesn't seem to be the case, so I'm just covering all avenues to be completely sure of that.

lmuserx4849, here's what I got from your command:
declare -i HISTCMD="32"
declare -- HISTFILE="/home/raiden/.bash_history"
declare -- HISTFILESIZE="500"
declare -- HISTSIZE="500"
bash: declare: PROMPT_COMMAND: not found
shopt -s cmdhist
shopt -u histappend
shopt -u histreedit
shopt -u histverify
shopt -u lithist

Thanks everyone for helping me track this down, and thanks to whoever fixed my post title too! lol

[lmuserx4849]

Interesting. That doesn't look like the one installed by Linux Mint. When a new user is created /etc/skel/.bashrc is copied to that user's $HOME directory, so you can view that file to see the original content.

At a minimum, try:
HISTSIZE=1000 # in memory
HISTFILESIZE=2000 # on disk
HISTCONTROL="ignoreboth:erasedups"
shopt -s histappend

Consider bumping up HISTFILESIZE and HISTSIZE a lot. Setting them to a negative number makes them unlimited.

Reference: Bash Online Doc or command man bash.

[megosdog]

Hmm, I've looked everywhere for why this happened, and I can't find anything. So I think at this point, to prevent this in the future, I need to implement "Bash eternal history" on my machine. We use it at work and it's priceless. So I think I'm going to start using it here. That way if this happens again I'll be able to go back and find out why....hopefully. If not, then I'll still be able to recover my bash history. ^_^

[JakubRimal]

It happens to me as well from time to time (e.g. after a few months), it seems that there is no way how to find out what happened so I'm going to write some simple backup script which will make a copy of my .bash_history every day...

Currently on Cinnamon 19.3 but it happened on previous versions as well.

Output of declare -p ${!HI@} PROMPT_COMMAND;shopt -p | grep hist:

Code: Select all

declare -i HISTCMD="768"
declare -- HISTCONTROL="ignoreboth"
declare -- HISTFILE="/home/rimal/.bash_history"
declare -- HISTFILESIZE="2000000"
declare -- HISTSIZE="1000000"
declare -- PROMPT_COMMAND="preexec_set_exit;preexec_invoke_cmd"
shopt -s cmdhist
shopt -s histappend
shopt -u histreedit
shopt -u histverify
shopt -u lithist

Any tip/help would be very appreciated.

[llr51]

If you have multiple terminals opened - and you do not close all of them, the history file will be marked at the entry of the last closed terminal (this is true for mate-terminal - probably for others).

If you reboot or power off the computer without a proper shutdown, the history file will be missing entries as only one terminal will "own" the history file.

[JakubRimal]

I can understand missing entries in cases you've mentioned, but playing around with multiple terminals and improper shutdowns should never end up with an empty .bash_history file, right? And that is the point here: not missing entries, but missing the whole history.

[all41]

Been using Bleachbit?

[llr51]

I can understand missing entries in cases you've mentioned, but playing around with multiple terminals and improper shutdowns should never end up with an empty .bash_history file, right? And that is the point here: not missing entries, but missing the whole history.

It has not happened to me yet in Linux - but I did see it happen in Unix (HPUX, AIX, and MP/RAS) flavors. If the file handle was the last entry in the intent log, the file would be empty - the real file ended up in lost+found if you fsck'ed the drive. (I supported a couple of thousand Unix computers for 20 years before the force retired me).

[JakubRimal]

Been using Bleachbit?

No, nothing like that, nothing special at all.

Now I do a backup every day so next time I'll hopefully be able to easily say what happened and I'll post my findings here again.