What could cause my bash history to be cleared unexpectedly?

When closing multiple bash instances at the same time, there is a known race condition that may cause the history to be cleared. This occurs because there is no locking used when the bash history file is written.

Chet Ramey (the current bash maintainer) gave a good summary of the conditions for this issue:

The current (bash-4.3-devel) code works something like this, assuming no errors (lib/readline/histfile.c:history_do_write()):

• rename (histfile, histfile~)
• open file with O_CREAT|O_TRUNC
• malloc buffer large enough to hold all history data
• write all of the history entries in one write(2) call
• close file
• unlink (histfile~)

The bash-4.2 code works the same way except that it does not back up the history file. Each shell does the same thing when it exits, assuming histappend is not set, as in your configuration.

There are a couple of ways the history file can end up zero-length: the malloc can fail, or the write can fail. In bash-4.2, it's too late to do anything about the truncated history file at that point. In bash-4.3, the previous history file will be restored.

This mailing list thread from bug-bash contains a decent discussion of the problems, possible solutions, and concerns surrounding this.

There are also some other possibilities:

• At some point, your HISTSIZE or HISTFILESIZE was set to 0
• At some point, your readline history-size was set to 0
• Someone, whether intentionally or unintentionally, wiped the bash history (via > "$HISTFILE" or similar)

In the latter case, you might want to check that someone hasn't been accessing your account and is trying to hide their tracks in a crude way. Take a look at last, /var/log/auth (or /var/log/secure on CentOS/RHEL), and if you have it, any process accounting and/or auditing software you may have installed.