.bash_history 中的行以 # 和整数开头

Question

我看到行包含 #1582696021 。这是什么？在 SIEM 中，我们使用它似乎是由用户运行的命令。

任何帮助或文档将不胜感激。

最好的事物

Answer 1

它们是时间戳。从man bash

       HISTTIMEFORMAT
              If  this  variable  is  set and not null, its value is used as a
              format string for strftime(3) to print the time stamp associated
              with  each  history  entry displayed by the history builtin.  If
              this variable is set, time stamps are  written  to  the  history
              file  so they may be preserved across shell sessions.  This uses
              the history comment character  to  distinguish  timestamps  from
              other history lines.

整数值是一个纪元时间 - 您可以使用date例如 ex将其转换为人类可读的时间。

$ date -d @1582696021
Wed Feb 26 00:47:01 EST 2020