--- title: Tracking down a Zsh history data loss bug | daily.dev description: A multi-year investigation into Zsh shell history data loss is documented in detail. The author used inotify, fatrace, bpftrace, and ultimately a custom... canonical: https://daily.dev/posts/tracking-down-a-zsh-history-data-loss-bug-c9paxgbvu twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Tracking down a Zsh history data loss bug | daily.dev og:description: A multi-year investigation into Zsh shell history data loss is documented in detail. The author used inotify, fatrace, bpftrace, and ultimately a custom... og:url: https://daily.dev/posts/tracking-down-a-zsh-history-data-loss-bug-c9paxgbvu og:image: https://api.daily.dev/og/posts/c9paXGBVU.png og:image:alt: Tracking down a Zsh history data loss bug og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Tracking down a Zsh history data loss bug **[Lobsters](https://daily.dev/sources/lobsters)** · 24 min read · 4 upvotes · 0 comments ## Summary A multi-year investigation into Zsh shell history data loss is documented in detail. The author used inotify, fatrace, bpftrace, and ultimately a custom crash-inducing Zsh patch plus core dump analysis to pinpoint the root cause: when exiting, Zsh's `savehistfile` calls `readhistfile` to compact history, but `readhistfile` can be interrupted mid-read by a SIGINT (e.g., from pressing Ctrl+C while closing terminal sessions). The interrupted read leaves an incomplete history in memory, which `savehistfile` then faithfully writes out, truncating the file. The bug is fixed in Zsh 5.9.2 (released July 12, 2026). The post also benchmarks frontier and open-weight LLMs on their ability to diagnose the bug from symptoms and bpftrace output, finding that GPT-5.6 Sol and Claude Opus 5 can identify it reliably without hints. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why does my zsh history file (.zsh_history) sometimes get truncated to old entries after I log out? Truncation happens when a SIGINT (Ctrl+C) interrupts zsh's readhistfile function while it is reading the full history file during exit-time compaction in savehistfile. readhistfile aborts its read loop early on interruption, but savehistfile does not check for that interruption before writing out and renaming the incomplete data over the original .zsh_history file, causing data loss. This was fixed in Zsh 5.9.2. _Anyone chasing flaky shell history loss can find version-specific zsh fixes and postmortems like this through daily.dev._ ### How can I trace which process is deleting or truncating a file on Linux when inotifywait doesn't show the PID? Use fatrace instead of inotifywait, since fatrace displays both the process name and PID for file access events, while fanotify (which fatrace relies on) provides PID information that fsnotifywait does not expose. For deeper visibility into read/write byte counts and syscall-level behavior, bpftrace can trace open, read, write, lseek, rename, and unlink syscalls filtered by process name. _Developers debugging tricky file-system corruption can track tracing tool tips like this via daily.dev._ ### Which zsh version fixes the history truncation bug caused by SIGINT during exit-time history compaction? Zsh 5.9.2, released July 12th 2026, contains the fix. The fix was originally written by Bart Schaefer in April 2025 after a bug report to the zsh-workers mailing list in March 2025, but it was accidentally omitted from the 5.9.1 release by the release engineer before finally landing in 5.9.2. Users pinning zsh on Debian should pin both the zsh and zsh-common packages together. _Teams pinning shell versions to dodge regressions can track releases like zsh 5.9.2 through daily.dev._ ## Community take How the wider developer community reacted, aggregated from 2 discussions and 9 comments across lobsters, hackernews (as of 2026-09-13). **TL;DR:** Commenters are largely enthusiastic and relieved — many have experienced this exact Zsh history loss for years and are glad it's finally tracked down and fixed. The LLM benchmarking section also drew genuine interest. **Sentiment:** 80% positive · 15% mixed · 5% skeptical **The case for** - Several people confirmed they had suffered from this bug for years, validating the investigation's real-world impact. - The writeup was praised for making advanced debugging tools (inotify, bpftrace, etc.) approachable to non-experts. - The LLM benchmarking section was highlighted as a compelling standalone topic worth expanding into its own post. **The pushback** - Running frontier-model evals as a personal hobby is prohibitively expensive (author notes spending over $500 USD). - The Inspect leaderboard/result browser was found unintuitive, making it hard to track different evaluation approaches. **By community** - lobsters (positive): Commenters confirmed the bug from personal experience, praised the approachable writeup, and expressed excitement about the fix landing in Zsh 5.9.2; a side thread explored share_history workarounds. - hackernews (mixed): No comments were present, so no signal is available beyond the submission itself. **Open questions** - Are there better eval/leaderboard tools than Inspect for tracking LLM benchmark experiments across multiple runs? - Does the fix fully cover history loss for users sharing history across multiple concurrent shells? **Highlights** > Pleasantly surprised by this because I've been complaining about zsh losing my history entries for years and I'm excited about the possibility that this could be the fix.. Kudos to the author for tracking this down. The fix: https://github.com/zsh-users/zsh/commit/bacc78ec3f This is tagged as `zsh-5.9.0.2-test`, so I guess 5.9.0.2 is the earliest version that'll have the fix. > — [osa1 on lobsters · 2 points, 3 comments](https://lobste.rs/s/x0jlp7/tracking_down_zsh_history_data_loss_bug#c_z0unwa) > Thanks for this excellent writeup! As always, I found it helpful how you describe so many advanced tools in a way that's approachable to people who have no experience with them. I really enjoyed the benchmarking part. I'd be interested in an entire post on that. > — [mtlynch on lobsters · 1 points, 1 comments](https://lobste.rs/s/x0jlp7/tracking_down_zsh_history_data_loss_bug#c_dgffav) > Thanks for the kind words, and the feedback on expanding on the evals. Yeah, there’s definitely a lot to expand on. I’d be curious if anyone found better eval tools than [Inspect](https://inspect.aisi.org.uk/). In particular, I found the leaderboard / result browser unintuitive and kept losing track of different approaches. With better tooling, it’d be interesting to try different harnesses (and also orchestration approaches) — it’s odd that so many models run into time limits when I don’t see that behavior in coding agents day-to-day. Maybe they don’t have a task list tool available, or are lacking a scratchpad, or don’t have a memory tool, or similar…? That said, running such evals with frontier models costs a lot of money very quickly. I think at this point, I have spent well over 500 USD in total (I did a few more experiments on top of what I described in the post). So doing it as a personal hobby is quite expensive. > — [stapelberg on lobsters · 1 points](https://lobste.rs/s/x0jlp7/tracking_down_zsh_history_data_loss_bug#c_isiyvr) > I have indeed run in to this same problem and always assumed I was doing something wrong. I switched to atuin and never looked back, but it's good to know I wasn't imagining things. > — [danlamanna on lobsters · 1 points](https://lobste.rs/s/x0jlp7/tracking_down_zsh_history_data_loss_bug#c_3mxfzc) **Source threads** - [lobsters](https://lobste.rs/s/x0jlp7/tracking_down_zsh_history_data_loss_bug) · 14 points · 9 comments - [hackernews](https://news.ycombinator.com/item?id=49229488) · 5 points · 0 comments ## Similar posts on daily.dev - [8 Useful Ways to Configure Your Zsh History — Nick Janetakis](https://daily.dev/posts/8-useful-ways-to-configure-your-zsh-history-nick-janetakis-b94vzinwy) · Nick Janetakis · 10 upvotes · 1 comments - [Linux command line tips: HISTCONTROL, frozen screens, and more](https://daily.dev/posts/linux-command-line-tips-histcontrol-frozen-screens-and-more-zrtv8potx) · All Things Open · 2 upvotes · 1 comments - [Life is too short for a slow terminal](https://daily.dev/posts/life-is-too-short-for-a-slow-terminal-lqylqjjiy) · Lobsters · 1 upvotes · 1 comments - [Finding and Fixing Ghostty's Largest Memory Leak](https://daily.dev/posts/finding-and-fixing-ghostty-s-largest-memory-leak-e80o1yj0s) · Mitchell Hashimoto · 14 upvotes · 4 comments --- Tags: [#linux](https://daily.dev/tags/linux), [#bash](https://daily.dev/tags/bash) [View this post on daily.dev](https://daily.dev/posts/tracking-down-a-zsh-history-data-loss-bug-c9paxgbvu) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Tracking down a Zsh history data loss bug","url":"https://daily.dev/posts/tracking-down-a-zsh-history-data-loss-bug-c9paxgbvu","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/tracking-down-a-zsh-history-data-loss-bug-c9paxgbvu"},"datePublished":"2026-08-09T15:02:06.041Z","dateModified":"2026-09-13T19:18:49.217Z","description":"A multi-year investigation into Zsh shell history data loss is documented in detail. The author used inotify, fatrace, bpftrace, and ultimately a custom...","image":"https://media.daily.dev/image/upload/s--1KxV4ohY--/f_auto/v1722860400/public/Placeholder%2007","thumbnailUrl":"https://media.daily.dev/image/upload/s--1KxV4ohY--/f_auto/v1722860400/public/Placeholder%2007","isAccessibleForFree":true,"articleSection":"Lobsters","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Lobsters","logo":"https://media.daily.dev/image/upload/s--tl8v_Fku--/f_auto,t_logo/v1698841318/logos/lobste.jpg","url":"https://daily.dev/sources/lobsters"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/tracking-down-a-zsh-history-data-loss-bug-c9paxgbvu","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":4},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"linux,bash","timeRequired":"PT24M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Lobsters","item":"https://daily.dev/sources/lobsters"},{"@type":"ListItem","position":3,"name":"Tracking down a Zsh history data loss bug"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/tracking-down-a-zsh-history-data-loss-bug-c9paxgbvu#faq","mainEntity":[{"@type":"Question","name":"Why does my zsh history file (.zsh_history) sometimes get truncated to old entries after I log out?","acceptedAnswer":{"@type":"Answer","text":"Truncation happens when a SIGINT (Ctrl+C) interrupts zsh's readhistfile function while it is reading the full history file during exit-time compaction in savehistfile. readhistfile aborts its read loop early on interruption, but savehistfile does not check for that interruption before writing out and renaming the incomplete data over the original .zsh_history file, causing data loss. This was fixed in Zsh 5.9.2. Anyone chasing flaky shell history loss can find version-specific zsh fixes and postmortems like this through daily.dev."}},{"@type":"Question","name":"How can I trace which process is deleting or truncating a file on Linux when inotifywait doesn't show the PID?","acceptedAnswer":{"@type":"Answer","text":"Use fatrace instead of inotifywait, since fatrace displays both the process name and PID for file access events, while fanotify (which fatrace relies on) provides PID information that fsnotifywait does not expose. For deeper visibility into read/write byte counts and syscall-level behavior, bpftrace can trace open, read, write, lseek, rename, and unlink syscalls filtered by process name. Developers debugging tricky file-system corruption can track tracing tool tips like this via daily.dev."}},{"@type":"Question","name":"Which zsh version fixes the history truncation bug caused by SIGINT during exit-time history compaction?","acceptedAnswer":{"@type":"Answer","text":"Zsh 5.9.2, released July 12th 2026, contains the fix. The fix was originally written by Bart Schaefer in April 2025 after a bug report to the zsh-workers mailing list in March 2025, but it was accidentally omitted from the 5.9.1 release by the release engineer before finally landing in 5.9.2. Users pinning zsh on Debian should pin both the zsh and zsh-common packages together. Teams pinning shell versions to dodge regressions can track releases like zsh 5.9.2 through daily.dev."}}]} ```