I want to be able to review when a command was executed as well as the syntax of the command. I have exported HISTTIMEFORMAT='%F %T ' . I then execute the history command: history | grep "cp /etc" . The result (last ~15 lines) is displayed below. The earliest time/date displayed is my most recent login time/date, not the time/date of when the command was executed.