bash History Tips - Making the Most of Your Command History
What You'll Learn
- List and reuse past commands with
history - Search history instantly with
Ctrl+R - Use
!!and!$shortcuts to avoid retyping - Customize history behavior with
HISTSIZEandHISTCONTROL
1. The history Command
history and bash shows all your past commands with numbers.$ history 498 ls -la /var/log 499 sudo apt update 500 grep -r "error" /var/log/syslog 501 cd /home/ubuntu 502 history
Each line has a history number on the left. You can use that number to re-run a specific command later.
Filter with grep
$ history | grep apt 499 sudo apt update 485 sudo apt install vim 470 apt search nginx
Pipe history into grep to find the command you're looking for without scrolling through everything.
Show only the last N entries
$ history 10
Pass a number to see only the most recent N commands.
2. Arrow Keys
| Key | Action |
|---|---|
↑ |
Previous command |
↓ |
Next command (forward in history) |
Ctrl+A |
Move cursor to start of line |
Ctrl+E |
Move cursor to end of line |
If you've gone too far back, press ↓ to move forward again. Press Ctrl+C to cancel without running anything.
3. Ctrl+R: Reverse Incremental Search
Ctrl+R comes in. Just type a keyword and bash finds matching commands instantly.Press Ctrl+R and the prompt changes to:
(reverse-i-search)`':
Start typing and bash shows matching commands in real time:
(reverse-i-search)`apt': sudo apt update
Ctrl+R key reference
| Key | Action |
|---|---|
Ctrl+R |
Start reverse search / jump to older match |
Ctrl+S |
Jump to newer match (may need to enable) |
Enter |
Run the displayed command |
← → |
Switch to edit mode instead of running |
Ctrl+G |
Cancel search and return to empty prompt |
Ctrl+S is often intercepted by terminal flow control (XON/XOFF). If it doesn't respond, add stty -ixon to your .bashrc and restart your shell.
4. History Expansion: !!, !$, and More
!! in commands online but I don't understand what it does.!! means "the entire last command I ran." The classic use case is fixing a forgotten sudo.!! — Repeat the last command
$ apt update E: Could not open lock file /var/lib/dpkg/lock-frontend... $ sudo !! sudo apt update
Typing sudo !! automatically becomes sudo apt update and runs it.
bash always shows you the expanded command before running it, so you can see exactly what !! became.
!$ — Last argument of the previous command
$ mkdir -p /var/log/myapp $ cd !$ cd /var/log/myapp
!$ expands to the last word of the previous command. Great for avoiding long path rewrites.
!^ — First argument of the previous command
$ diff file1.txt file2.txt $ vim !^ vim file1.txt
!^ expands to the first argument of the previous command.
!n — Re-run by history number
$ history | grep grep 500 grep -r "error" /var/log/syslog $ !500 grep -r "error" /var/log/syslog
Use ! followed by a history number to re-run that specific command.
History expansion runs immediately without a confirmation step. Be especially careful with destructive commands — always verify what !! will expand to before pressing Enter.
5. HISTSIZE and HISTFILESIZE
Add these lines to ~/.bashrc:
HISTSIZE=10000 # commands kept in memory during the session HISTFILESIZE=20000 # lines saved to ~/.bash_history on exit
Reload to apply:
$ source ~/.bashrc
About ~/.bash_history
When you exit bash, the session's commands are written to ~/.bash_history. HISTFILESIZE caps how many lines that file can hold.
$ wc -l ~/.bash_history 1247 /home/ubuntu/.bash_history
6. HISTCONTROL — Remove Noise from History
# Add to ~/.bashrc HISTCONTROL=ignoreboth
| Value | Effect |
|---|---|
ignorespace |
Skip commands that start with a space |
ignoredups |
Skip consecutive duplicate entries |
ignoreboth |
Both of the above (most common choice) |
erasedups |
Remove all duplicates from the entire history |
Keep sensitive commands out of history
$ secret-command --password=mypassword
Start a command with a leading space and (with ignorespace active) bash won't record it. Useful when you must type a credential on the command line.
7. HISTTIMEFORMAT — Add Timestamps
# Add to ~/.bashrc HISTTIMEFORMAT="%Y-%m-%d %T "
$ history 5 998 2026-06-01 10:23:45 ls -la 999 2026-06-01 10:24:12 cd /var/log 1000 2026-06-01 10:25:30 sudo apt update 1001 2026-06-01 10:26:01 tail -f /var/log/syslog 1002 2026-06-01 10:28:44 history 5
Timestamps help answer "when exactly did I run that?" during post-incident reviews or audit trails.