Bash · XB Field Notes

Bash history is your searchable command log

Mon, 28 Feb 2028 00:00:00 +0000

A useful command history saves retyping, but it is not a complete record of everything executed. Bash normally enables history in interactive shells, and settings can exclude entries or limit retention. The searchable list in a running shell and the history file on disk are separate states. That distinction explains why a command may be visible in one terminal, absent in another, and lost when an unwritten session ends unexpectedly.

History is local to each running shell until explicit file operations connect those states. Appending does not refresh another shell; importing the whole file can duplicate entries, while replacement can discard other sessions’ records. Shared history is not a reliable global execution log.

Session memory differs from the file

HISTSIZE limits in-memory history entries; HISTFILESIZE controls file retention using a line-based target. The current Bash manual allows complete multiline entries to exceed that target rather than retaining partial entries. Multiline commands and timestamp records also mean raw line counts are not command counts. HISTFILE selects the file, normally the user’s Bash history file. An unset or empty value prevents ordinary saving, and an unwritable location can leave apparently healthy in-memory recall with no persistent record.

Bash records command text before parameter expansion but after history expansion, subject to HISTCONTROL and HISTIGNORE. A saved line containing a variable therefore does not necessarily reveal the value used during the original execution. Current directories, aliases, functions, environment values, and external files can all change before a command is recalled. History preserves useful input, not a reproducible execution environment or a trustworthy audit trail.

Appending does not refresh other terminals

On normal exit, Bash saves history; histappend selects appending rather than overwriting the file. Without earlier writes, abnormal termination can lose all unsaved entries, not merely the final command. history -a appends newly entered lines that this session has not already appended. Saving before exit reduces that loss window, but does not promise durable storage through every system failure.

Another running shell has its own list. It needs an import such as history -n to read newly appended lines; enabling histappend alone does not make another terminal’s searches update live. history -r reads the entire file into the existing list and can introduce duplicates. history -w replaces the file with the current list and can discard other sessions’ records. These operations should not be treated as interchangeable synchronization commands.

If append and import operations are integrated into PROMPT_COMMAND, preserve existing prompt hooks and any use of the preceding command’s status. Replacing a configured hook wholesale can break other shell behavior. Concurrent sessions also do not create a reliable global execution order merely by sharing a file. Keep separate operational logs when ordering, exit status, or accountability matters.

Search, inspect, then execute

In the usual Emacs-style Readline bindings, Ctrl-R searches backward incrementally, and pressing it again finds older matches. A movement key leaves the search for editing; Ctrl-G cancels it. With default isearch-terminators, Ctrl-J ends incremental search and leaves the match on the editing line without executing it. Enter accepts the line. Outside that search state, Ctrl-J normally accepts a line too, so check the current mode and bindings before relying on it as a preview key.

Inspect the hostname, directory, options, and intended target whenever reusing an old command. A command that was correct last month may address a different environment today. Prefer a distinctive search fragment and review the whole line, rather than trusting that the first matching command is the right operation.

When it breaks

Missing commands can result from filtering, retention limits, a different history file, failed saving, or an unrefreshed session. Check those causes separately. ignoredups excludes consecutive duplicates, not every duplicate in the entire list. ignoreboth combines that behavior with ignorespace; it does not produce a globally unique command archive.

A leading space excludes an entry only when the relevant setting is active. It does not remove terminal recordings, process arguments, or logs written elsewhere, so do not put credentials directly into command lines and rely on history filtering for secrecy. Diagnostic examples should use synthetic entries and a temporary history file, rather than printing someone’s real recent commands.

Check it quickly

Run this with Python 3, Bash, and standard Unix utilities. The environment points Bash to a temporary file before it starts. Only synthetic entries are inspected. The brace group avoids recording the demonstration’s own control commands after history is enabled.

import os
import subprocess
import tempfile
from pathlib import Path

script = r'''{
set -eu
set -o history
history -c
history -s 'demo original'
history -w "$HISTFILE"
printf 'first-file:\n'
cat "$HISTFILE"
history -c
history -s 'demo replacement'
history -w "$HISTFILE"
printf 'replacement-file:\n'
cat "$HISTFILE"
history -r "$HISTFILE"
printf 'memory-after-reread:\n'
history | sed 's/^[[:space:]]*[0-9][0-9]*[[:space:]]*//'
unset HISTFILE
}'''
with tempfile.TemporaryDirectory(prefix="bash-history-demo-") as directory:
 history_path = Path(directory) / "history"
 env = dict(os.environ, BASH_ENV="", HISTFILE=str(history_path), HISTSIZE="100",
 HISTFILESIZE="100", HISTCONTROL="", HISTIGNORE="",
 HISTTIMEFORMAT="")
 subprocess.run(["bash", "--noprofile", "--norc", "-c", script],
 env=env, check=True)

The first file contains demo original; after replacement it contains only demo replacement. Reading that file into a list already containing the replacement produces two identical entries in memory. This verifies overwrite and import semantics without executing the stored strings. It does not claim to test keyboard bindings or crash durability, which require their own observations.

A 2026-10-19 rerun passed this exact temporary-file exercise using Python 3.12.14 and Bash 5.2.37 on Linux 6.18.55. It did not exercise interactive keys or inspect user history.

Sources

Bash history facilities, session lists and saving to the history file, checked 2026-09-07.
Bash history builtins, append and replacement versus importing entries, checked 2026-09-07.
Readline history commands, search and command-acceptance bindings, checked 2026-09-07.
Bash reference manual, HISTFILESIZE whole-entry retention and section 8.2.5 search-state termination, checked 2026-10-19.

Bash globbing expands before the command runs

Wed, 08 Sep 2027 00:00:00 +0000

A wildcard in a Bash command usually becomes a list of pathnames before the target program starts. That makes *.txt convenient, but it also makes the command depend on the current directory and shell options. The program receives arguments, without information saying which ones came from a wildcard. Decide whether you intend to pass matching files or a pattern for the program to interpret.

Filename expansion preserves spaces inside each match. No-match options and downstream program semantics remain separate decisions.

Match first, then preserve the arguments

Bash performs word splitting before filename expansion. An unquoted *, ?, or bracket expression can therefore produce several arguments. A matching filename containing spaces remains one argument: Bash does not run another word-splitting pass over the filenames it just found. The common loss of spaces happens later when a loop expands its variable without quotes. Use "$file" when passing each matched pathname onward.

Quote a pattern when its recipient needs the pattern itself. For example, find . -name '*.txt' gives the matching expression to find; leaving it unquoted lets Bash expand it against the current directory first. A quoted variable containing an asterisk also stays literal. An unquoted variable containing an asterisk can trigger pathname expansion, even though the star was not written directly in the command.

A pattern operates on directory entries, not a promised collection of regular files. A directory named archive.txt also matches *.txt. Use a file-type check when that distinction matters. Ordinary stars do not cross slashes, and leading dots require explicit matching unless dotglob is enabled. Recursive traversal needs its own deliberate approach; plain * does not search the whole tree.

The environment can also change which names qualify. In Bash, setting GLOBIGNORE to a nonempty value filters matching names and enables dotglob as a side effect. A script inherited from an interactive session may therefore see hidden files unexpectedly. The fixture clears GLOBIGNORE and the newer GLOBSORT ordering override, then selects its options explicitly so its assertions describe a reproducible configuration.

When it breaks

By default, an unmatched pattern stays as literal text. A loop over *.png can consequently run once with a nonexistent filename. With nullglob enabled, the pattern disappears instead. This avoids that literal but introduces another risk: a command receiving no file arguments may read standard input, or apply its own default target. Neither nounset nor pipefail checks that a glob found files.

For optional inputs, collect matches in a Bash array with nullglob and test its element count before invoking the consumer. For required matches, failglob rejects an unmatched expansion before the command runs. Keep option changes inside a subshell when callers should retain their original settings. Do not assume a script’s behavior matches an interactive shell whose startup files changed those options.

A filename beginning with a hyphen may be interpreted as an option by the receiving program. Expanding ./*.txt prefixes such names with a directory component; use the program’s documented -- separator where supported as well. Quoting preserves argument boundaries but does not change option parsing. Finally, enumeration and use are separate events: files can disappear between them, so a successful match is not proof that a later read will succeed.

Check it quickly

Run the following block with Bash and the usual temporary-directory tools. It creates an isolated directory, checks literal and expanded arguments, exercises both no-match policies, and removes only its own fixture. It does not require any preexisting text files.

bash --noprofile --norc <<'BASH'
set -e
export LC_ALL=C
set +f
unset GLOBIGNORE GLOBSORT
shopt -u nullglob failglob dotglob
work=$(mktemp -d)
trap 'rm -rf -- "$work"' EXIT
cd "$work"
touch -- a.txt 'two words.txt' .hidden.txt -option.txt
files=(./*.txt)
[[ ${#files[@]} -eq 3 ]]
[[ ${files[2]} == './two words.txt' ]]
printf 'match <%s>\n' "${files[@]}"
literal=('*.txt')
[[ ${literal[0]} == '*.txt' ]]
missing=(./*.missing)
[[ ${missing[0]} == './*.missing' ]]
shopt -s nullglob
missing=(./*.missing)
[[ ${#missing[@]} -eq 0 ]]
if (shopt -s failglob; printf '%s\n' ./*.missing) 2>/dev/null; then
 printf 'unexpected match\n' >&2
 exit 1
fi
shopt -s dotglob
files=(./*.txt)
[[ ${#files[@]} -eq 4 ]]
printf 'PASS: spaces, literal, no-match policies, hidden file\n'
BASH

Expect three initial match lines, with the spaced filename on one line, followed by the PASS message. The hidden file appears only in the final array after dotglob is enabled. The failing subshell is intentional and must not print an expanded filename. These assertions verify Bash expansion and argument preservation; they do not establish how an arbitrary downstream tool handles missing operands, directories, or options. Check that tool’s contract before replacing the harmless printf with a real operation.

Sources

GNU Bash: Filename Expansion, matching rules and no-match options, checked 2026-09-06.
GNU Bash: Shell Expansions, ordering and changes to argument count, checked 2026-09-06.
GNU Bash: Arrays, collecting matches and preserving elements, checked 2026-09-06.