Linux commands: history

Interactive shells usually keep command history in memory and periodically save it to a file. The exact file size, save timing, duplicate handling, and sharing between terminals depend on the shell configuration.

You can display all the history using:

history

This shows recorded commands with numbers:

In shells with history expansion, !121 repeats entry 121. Print or edit a command before running it when it can modify data. !! repeats the previous command, which is convenient but dangerous after a typo or after changing directories.

Search text with the shell’s reverse search, often Ctrl-R, or filter the list:

history | grep docker

History is not a secure audit log. A user can edit or clear it, several shells can overwrite one another’s updates, and non-interactive commands may not be recorded. Use system logs or dedicated auditing for accountability.

It is also a secret-leak risk. Tokens and passwords typed as command arguments may be written to the history file. Prefer interactive prompts, standard input where appropriate, or a secret manager. If a secret was exposed, deleting one history line does not revoke it or remove it from process logs, terminal scrollback, backups, or remote systems—rotate the secret first.

history -c behavior and persistence vary by shell. Clearing the in-memory list may not remove the saved file, and another open shell may write old entries back. Check your Bash or zsh documentation before relying on it.

Try it: use reverse search to find a harmless earlier command, edit it without executing the original unchanged, then inspect which history file your shell uses.

History features are shell behavior, so Bash and zsh details can differ even on the same operating system.