When I turn on timestamps for history, .bash_history records without a timestamp (and possibly in-memory records without a timestamp - not sure, haven't tested) inherit the modified timestamp of .bash_history next time it is read.
This obviously causes old commands to have a much newer date. I look at HISTTIMEFORMAT as display formatting only, since it writes to .bash_history with since-epoch time. My fix would be to log since-epoch timestamps for each command in .bash_history, and if someone has default HISTTIMEFORMAT, just not to show the timestamps. I'd also implement a backup fix, because you can't retroactively get timestamps for previous commands. And, failing my original fix, this one would make the situation better. I'd have .bash_history commands without a timestamp report as timestamp 0 - 1/1/1970 - rather than the .bash_history modified date, to at least be clear something's off, rather than stealthly report a wrong timestamp. ---Full history customizations--- ========== shopt -s histappend export HISTSIZE=-1 export HISTFILESIZE=-1 export HISTTIMEFORMAT="%Y-%m-%d %H:%M:%S " export HISTCONTROL=ignorespace ==========
