Bash history mysteriously wiped?
Forum rules
Before you post read how to get help. Topics in this forum are automatically closed 6 months after creation.
Before you post read how to get help. Topics in this forum are automatically closed 6 months after creation.
Bash history mysteriously wiped?
Okay, I've got an honestly weird one that has never happened to me, and I just noticed that it happened. Anyhow, I'm one who never wipes his bash history. There's too many useful commands in there to do that. Anyhow, apparently several days ago my entire bash history got zeroed out. It appears to have been zeroed out sometime between my backups in the 24th of February and the 25th. The thing is, I didn't do it. So my only two thoughts are, someone somehow got into my system and did something, then wiped bash history to cover their tracks, or a recent update that pushed around the 24th or 25th did that. Since I see nothing else on my computer to make me think that I got hacked, so I'm wondering what could have deleted my bash history and why? I only ask because it seems so out of character for an update or something else to just completely purge the file like that unless it was someone covering their tracks. Anyone got any ideas?
Last edited by LockBot on Wed Dec 28, 2022 7:16 am, edited 2 times in total.
Reason: Topic automatically closed 6 months after creation. New replies are no longer allowed.
Reason: Topic automatically closed 6 months after creation. New replies are no longer allowed.
Re: Bash histery mysteriously whipped?
I'm venturing into unfamiliar territory here, so I may be way off base, but:
Did you possibly play around a bit with your .bashrc file back then? Open the file with
If that second line is commented out, that might explain what happened.
Did you possibly play around a bit with your .bashrc file back then? Open the file with
xed ~/.bashrc
(replace xed with your text editor.) Find the lines that should look like this:# append to the history file, don't overwrite it
shopt -s histappend
If that second line is commented out, that might explain what happened.
Re: Bash histery mysteriously whipped?
Is it possible you have created or logged in as a different user?
Everything in life was difficult before it became easy.
Re: Bash histery mysteriously whipped?
MrEen: Haven't touched that since way back in August when I did my latest system install. My current bashrc looks like this:
It'd been compiling bash_history entries right up until the 25th when it was wiped to zero. It's totally weird. I never touched the file at all. That's what's so baffling.
all41: Nope, same user as always. It's like everything in the file just went away and I don't know why. The only change I can think of around that time was that I was doing regular updates via the update manager.
Code: Select all
alias du='du --max-depth=1'
export MOZ_DISABLE_PANGO=1
alias locate='locate -i'
DEFAULT=$PS1
PS1="\[\033[1;31m\]\u@Desktop: \w\$\[\033[00m\] "
all41: Nope, same user as always. It's like everything in the file just went away and I don't know why. The only change I can think of around that time was that I was doing regular updates via the update manager.
Re: Bash histery mysteriously whipped?
just a thought
does ~/.bash_history/Properties/Permissions show you as owner and group with read/write priveleges?
does ~/.bash_history/Properties/Permissions show you as owner and group with read/write priveleges?
Everything in life was difficult before it became easy.
Re: Bash history mysteriously wiped?
Hi megosdog,
I just read your post and the good replies to it. Here are my thoughts on this as well.
Did you run any cleaning or space cleaning utilities, is your drive almost out of space, etc...?
FYI: Came across this great article on using bash history.
How To Use History Command Effectively In Linux | 2daygeek.com
https://www.2daygeek.com/how-to-use-his ... in-linux/#
You might be able to restore the bash history from a backup ...
I just read your post and the good replies to it. Here are my thoughts on this as well.
Did you run any cleaning or space cleaning utilities, is your drive almost out of space, etc...?
FYI: Came across this great article on using bash history.
How To Use History Command Effectively In Linux | 2daygeek.com
https://www.2daygeek.com/how-to-use-his ... in-linux/#
You might be able to restore the bash history from a backup ...
Phd21: Mint 20 Cinnamon & KDE Neon 64-bit Awesome OS's, Dell Inspiron I5 7000 (7573, quad core i5-8250U ) 2 in 1 touch screen
Re: Bash histery mysteriously whipped?
declare -p ${!HI@} PROMPT_COMMAND;shopt -p | grep hist
Take a look at the output from the above command.
You should see, output like:
export PROMPT_COMMAND='history -a;history -r'
shopt -s histappend
Beside something external, those are the options that would impact history. If you are using multiple terminals/tabs, double check $PROMPT_COMMAND.
- Arch_Enemy
- Level 6
- Posts: 1491
- Joined: Tue Apr 26, 2016 3:28 pm
Re: Bash history mysteriously wiped?
Places...
Recent Documents...
Clear Recent Documents...
?
Also clears your BASH history...
Recent Documents...
Clear Recent Documents...
?
Also clears your BASH history...
I have travelled 37629424162.9 miles in my lifetime
One thing I would suggest, create a partition as a 50G partition as /. Partition the rest as /Home. IF the system fails, reinstall and use the exact same username and all your 'stuff' comes back to you.
One thing I would suggest, create a partition as a 50G partition as /. Partition the rest as /Home. IF the system fails, reinstall and use the exact same username and all your 'stuff' comes back to you.
Re: Bash history mysteriously wiped?
all41, I'm owner and group has zero perms.
phd21, nope. no cleaner scripts and its got tons of space. As for restoring it from backup, that I have. I run a daily snapshot backup to my secondary drive. It's just that I've never had bash history wiped before. So I'm just trying to figure out if it was caused by something the system did, or if I need to look deeper. IE, like a hack or something. So far it's looking a lot like something the system did, but I'm not able to nail down just what. Honestly I'm more worried about someone having gotten in and then wiped the history file to cover their tracks. That was my biggest concern. However, so far that doesn't seem to be the case, so I'm just covering all avenues to be completely sure of that.
lmuserx4849, here's what I got from your command:
declare -i HISTCMD="32"
declare -- HISTFILE="/home/raiden/.bash_history"
declare -- HISTFILESIZE="500"
declare -- HISTSIZE="500"
bash: declare: PROMPT_COMMAND: not found
shopt -s cmdhist
shopt -u histappend
shopt -u histreedit
shopt -u histverify
shopt -u lithist
Thanks everyone for helping me track this down, and thanks to whoever fixed my post title too! lol
phd21, nope. no cleaner scripts and its got tons of space. As for restoring it from backup, that I have. I run a daily snapshot backup to my secondary drive. It's just that I've never had bash history wiped before. So I'm just trying to figure out if it was caused by something the system did, or if I need to look deeper. IE, like a hack or something. So far it's looking a lot like something the system did, but I'm not able to nail down just what. Honestly I'm more worried about someone having gotten in and then wiped the history file to cover their tracks. That was my biggest concern. However, so far that doesn't seem to be the case, so I'm just covering all avenues to be completely sure of that.
lmuserx4849, here's what I got from your command:
declare -i HISTCMD="32"
declare -- HISTFILE="/home/raiden/.bash_history"
declare -- HISTFILESIZE="500"
declare -- HISTSIZE="500"
bash: declare: PROMPT_COMMAND: not found
shopt -s cmdhist
shopt -u histappend
shopt -u histreedit
shopt -u histverify
shopt -u lithist
Thanks everyone for helping me track this down, and thanks to whoever fixed my post title too! lol
Re: Bash history mysteriously wiped?
Interesting. That doesn't look like the one installed by Linux Mint. When a new user is created /etc/skel/.bashrc is copied to that user's $HOME directory, so you can view that file to see the original content.
At a minimum, try:
HISTSIZE=1000 # in memory
HISTFILESIZE=2000 # on disk
HISTCONTROL="ignoreboth:erasedups"
shopt -s histappend
Consider bumping up HISTFILESIZE and HISTSIZE a lot. Setting them to a negative number makes them unlimited.
Reference: Bash Online Doc or command
At a minimum, try:
HISTSIZE=1000 # in memory
HISTFILESIZE=2000 # on disk
HISTCONTROL="ignoreboth:erasedups"
shopt -s histappend
Consider bumping up HISTFILESIZE and HISTSIZE a lot. Setting them to a negative number makes them unlimited.
Reference: Bash Online Doc or command
man bash
.Re: Bash history mysteriously wiped?
Hmm, I've looked everywhere for why this happened, and I can't find anything. So I think at this point, to prevent this in the future, I need to implement "Bash eternal history" on my machine. We use it at work and it's priceless. So I think I'm going to start using it here. That way if this happens again I'll be able to go back and find out why....hopefully. If not, then I'll still be able to recover my bash history. ^_^
-
- Level 1
- Posts: 16
- Joined: Thu Jan 30, 2014 4:42 pm
Re: Bash history mysteriously wiped?
It happens to me as well from time to time (e.g. after a few months), it seems that there is no way how to find out what happened so I'm going to write some simple backup script which will make a copy of my .bash_history every day...
Currently on Cinnamon 19.3 but it happened on previous versions as well.
Output of
Any tip/help would be very appreciated.
Currently on Cinnamon 19.3 but it happened on previous versions as well.
Output of
declare -p ${!HI@} PROMPT_COMMAND;shopt -p | grep hist
:
Code: Select all
declare -i HISTCMD="768"
declare -- HISTCONTROL="ignoreboth"
declare -- HISTFILE="/home/rimal/.bash_history"
declare -- HISTFILESIZE="2000000"
declare -- HISTSIZE="1000000"
declare -- PROMPT_COMMAND="preexec_set_exit;preexec_invoke_cmd"
shopt -s cmdhist
shopt -s histappend
shopt -u histreedit
shopt -u histverify
shopt -u lithist
Re: Bash history mysteriously wiped?
If you have multiple terminals opened - and you do not close all of them, the history file will be marked at the entry of the last closed terminal (this is true for mate-terminal - probably for others).
If you reboot or power off the computer without a proper shutdown, the history file will be missing entries as only one terminal will "own" the history file.
If you reboot or power off the computer without a proper shutdown, the history file will be missing entries as only one terminal will "own" the history file.
-
- Level 1
- Posts: 16
- Joined: Thu Jan 30, 2014 4:42 pm
Re: Bash history mysteriously wiped?
I can understand missing entries in cases you've mentioned, but playing around with multiple terminals and improper shutdowns should never end up with an empty .bash_history file, right? And that is the point here: not missing entries, but missing the whole history.
Re: Bash history mysteriously wiped?
Been using Bleachbit?
Everything in life was difficult before it became easy.
Re: Bash history mysteriously wiped?
It has not happened to me yet in Linux - but I did see it happen in Unix (HPUX, AIX, and MP/RAS) flavors. If the file handle was the last entry in the intent log, the file would be empty - the real file ended up in lost+found if you fsck'ed the drive. (I supported a couple of thousand Unix computers for 20 years before the force retired me).JakubRimal wrote: ⤴Thu Feb 27, 2020 11:47 am I can understand missing entries in cases you've mentioned, but playing around with multiple terminals and improper shutdowns should never end up with an empty .bash_history file, right? And that is the point here: not missing entries, but missing the whole history.
-
- Level 1
- Posts: 16
- Joined: Thu Jan 30, 2014 4:42 pm