How to recover .bash_history?

UNIX for Advanced & Expert Users
1 
 rm -rf .bash_history

some one ran rm -rf .bash_history on my Linux server(SUSE),I can see this command being run in current history, but I want the OLD history as well,can I recover the old history back.

2

Restore the file from backup.

3

I dont have the backup unfortunately,its a newly installed system,
else would have done that.
moreover i want to see, what the other person did in the system that he had to delete the history.

4

Unfortunately there is no "undelete" in linux. You can try and look into logfiles like messages, audit.log, etc. to find some traces of what has happend.

5

hhmm.....yes i understand that...thanks a lot...
so there is no solution to this.....one thing can i do something so that it doesn't show rm -rf .bash_history in the current history.....

6

First run the history command to get a list of lines in the history:

$ history
    1  ./t
    2  ksh93 -c ./t
    3  ksh93 ./t
    4  ksh93 -c ./t
    5  ls
    6  history

then delete the line in question (for example line 5):

history -d 5
7

but then again....it will show history -d in next history command....
which could indicate someone tampered with history..

8

If you write a blank before the command, it should not be logged into the history.

---------- Post updated at 14:52 ---------- Previous update was at 14:47 ----------

Forgot to say, you have to set HISTCONTROL=ignorespace to activate this feature.

9

great...its working.,....thanks...
one more thing after reboot of server.....will it remain the same or does the permanent history from current .bash_history file will come up..

10

The history file will not be changed by a reboot. The ignore option has to be set every time you want to use it or you put the line into .bashrc .