Command History Cheat Sheet — Ubuntu & macOS

Most commands are shell-level (zsh/bash), so they work identically on both Ubuntu and macOS unless noted.

Basic history viewing

Reading the history file directly (works even outside a live session)

cat ~/.zsh_history        # zsh
cat ~/.bash_history       # bash
tail -50 ~/.zsh_history   # last 50 raw entries

Note: .zsh_history with EXTENDED_HISTORY on stores lines like : 1699999999:0;command, so raw cat looks messy — use the pretty-print trick below.

Searching history

history | grep "ssh"           # find all ssh commands ever run
grep "docker" ~/.zsh_history   # search the raw file directly
Ctrl+R                         # interactive reverse search (both shells)

Useful stats / frequency analysis

Most-used commands (top 20):

history | awk '{print $2}' | sort | uniq -c | sort -rn | head -20

(In zsh with timestamps on, the command starts at $4 instead of $2 — adjust if output looks off.)

Commands run today:

history | grep "$(date +%Y-%m-%d)"

Pretty-print zsh extended history (strip timestamps into readable form)

fc -li 1 | less

Clearing / managing history

history -c                 # clear current session history (bash)
history -p                 # purge zsh session history
> ~/.zsh_history            # wipe the history file on disk (careful!)
history -d 1234             # delete a specific entry number 1234 (bash)

Re-running previous commands quickly

!!              # re-run the last command
!123            # re-run history entry number 123
!ssh            # re-run the most recent command starting with "ssh"
!ssh:p          # print that command WITHOUT running it (safe preview)
sudo !!         # re-run the last command with sudo prepended (very handy)

Editing and re-running an old command (bash/zsh)

^old^new        # replace "old" with "new" in the last command, then run it
fc              # open the last command in an editor to modify, then run

Skip saving a specific command to history

 command_here   # a leading space skips saving it (requires HIST_IGNORE_SPACE in zsh)

Removing duplicate entries (zsh options)

setopt HIST_IGNORE_DUPS       # skip if identical to the immediately preceding command
setopt HIST_IGNORE_ALL_DUPS   # remove the older duplicate when a newer one is added
setopt HIST_FIND_NO_DUPS      # don't show duplicates while searching (Ctrl+R)
setopt HIST_SAVE_NO_DUPS      # don't save duplicate entries to the history file

Sharing history live across multiple open terminals (zsh)

setopt SHARE_HISTORY

Fuzzy history search with fzf (external tool, worth installing)

brew install fzf      # macOS
sudo apt install fzf   # Ubuntu
# After installing, Ctrl+R becomes a much richer fuzzy search

Checking your current history settings

echo $HISTSIZE
echo $SAVEHIST      # zsh only
echo $HISTFILE
set -o | grep hist   # bash: show history-related options

System-wide command auditing (not just your own shell) — for forensics/security

sudo apt install auditd     # Ubuntu
sudo ausearch -k history    # search by a defined rule key
sudo aureport --executable  # summary report of all executed commands system-wide

This differs from history in that it logs every user’s commands, even if they clear their own .bash_history — useful for security/forensics auditing rather than just reviewing your own commands.

Ubuntu-specific note

Ubuntu ships bash by default (unlike macOS’s zsh default since Catalina), so .bash_history is your primary file there unless you’ve switched shells. If you sudo apt install zsh and switch, the same zsh commands above apply identically.