6

I wanted to know if by default, does anything you enter into the terminal get logged somewhere in your system. I can imagine that to a certain degree it does because you can use the up and down arrows to recall commands entered, but acts similar to how RAM works in a computer, where once you close the terminal the commands are lost/removed? Or is there someone where within the computer that they are still being kept?

Gilles 'SO- stop being evil'
  • 829,060
TheHarpoon
  • 163

2 Answers2

8

short: no

long: It depends:

  • most shells have a history mechanism which records command-lines.
  • shell-history usually is configurable (and may not be activated).
  • But things like text-editors generally do not (your keystrokes are not logged—usually)

Also, even with shells, it is not common to be able to have multiple instances of shells running and record all of the commands from these instance.

Besides shell-history, there are other ways to record your commands, e.g., using low-level auditing programs (which record the resources which your commands use), or text-only things like script (which can record all of the information sent from the computer to the terminal).

Even if your shell is not configured to record commands, you may work in an environment where auditing is configured. For those "by default", there is a record.

Further reading:

Community
  • 1
Thomas Dickey
  • 76,765
  • Thank you, also found this useful to remove all history: cat /dev/null > ~/.bash_history && history -c && exit As a not very exp. user, can anyone break this down for me? – TheHarpoon Aug 13 '16 at 21:06
  • 1
    @TheHarpoon history -c clears the history. cat /dev/null > ~/.bash_history just truncates that file; erasing all the data in it. I don't know why you'd do that, since history -c does that, but perhaps it's a catch-all for unknown situations, or a way to verify that you have write access to the file so that the exit doesn't happen and mislead you into thinking the clear worked (but if you didn't have write access to the file your history wouldn't be saved in it anyways...), or something I'm not thinking of. But that's what those commands do. – Jason C Aug 14 '16 at 01:01
  • 1
    @JasonC Thank you, I found through trying it out that history -c clears the history and stops logging it during that current session, put once the terminal is closed/system rebooted and a new one opened I can still call in my history, but the the full command it has stopped it completely and erased all past entries. – TheHarpoon Aug 14 '16 at 21:06
  • 2
    @TheHarpoon Ah that must be it. My knowledge of history is a bit limited too. I guess ~\.bash_history keeps track of the history of all sessions persistently, and history -c just clears whatever's in memory or some per-session storage space. The command makes a lot more sense if that's how it works: clear the main big history file && clear the current session's data && peace out. – Jason C Aug 14 '16 at 21:10
3

It depends what shell you're using. If you're not using Windows and you are using your system's default shell then you're probably using the Bash shell.

The Bash shell stores a list of most of the commands you've entered in a file defined by the HISTFILE environment variable. By default this is ~/.histfile. By changing HISTFILE to something else you can store the history somewhere else. /dev/null is popular for those who want to hide their history. Bash also stores your history in RAM, which is why you can still use the up and down arrow keys even when you set HISTFILE to /dev/null.

Now, you'll notice I said most of the commands you've entered. Commands prefaced with a space don't show up in your history.

lsusr
  • 213