TECH **Git History Deep Dive: `git log` (oneline, graph, patch, reflog)**

Git History Deep Dive: git log (oneline, graph, patch, reflog)

A hyper-practical, zero-fluff guide for engineers who need to debug, audit, or recover code in production.

1. What This Is & Why It Matters

git log is your time machine for code. It lets you: - Debug regressions ("When did this bug get introduced?") - Audit changes ("Who modified this security-sensitive file?") - Recover lost work ("I accidentally deleted a branch—how do I get it back?") - Understand context ("Why was this hacky fix merged in the first place?")

Real-world scenario:
You’re a DevOps engineer oncall at 2 AM. A critical service starts failing after a deploy. The last commit message says "fix: typo", but the diff is 200 lines long. You need to: 1. Find the exact commit that broke things.
2. See the full changes (not just the summary).
3. Compare branches to identify what’s different in production vs. staging.
4. Recover a deleted branch that had the working code.

If you don’t master git log, you’ll waste hours digging through GitHub’s UI or manually diffing files. Worse, you might permanently lose work because you didn’t know git reflog exists.

2. Core Concepts & Components

1. git log (Basic)

• Definition: Shows the commit history in reverse chronological order (newest first).
• Production insight: Always use --oneline or --graph in shared repos—raw git log is unreadable in large projects.

2. --oneline

• Definition: Condenses each commit to a single line: <short-hash> <commit-message>.
• Production insight: Your team’s commit messages must be descriptive. "fix bug" is useless; "fix: race condition in user auth (issue #123)" saves hours.

3. --graph

• Definition: Visualizes branch history as an ASCII graph (shows merges, diverges, rebases).
• Production insight: If you’re debugging a merge conflict or tracking down a feature branch, --graph is non-negotiable. Without it, you’re flying blind.

4. --patch (-p)

• Definition: Shows the full diff of each commit (what changed, line by line).
• Production insight: When a bug appears, -p lets you see the exact code change that caused it. No more guessing.

5. --stat

• Definition: Shows a summary of changes (files modified, insertions/deletions).
• Production insight: Useful for quick audits (e.g., "Did this PR touch the database schema?").

6. --grep=<pattern>

• Definition: Filters commits by message content (e.g., --grep="fix").
• Production insight: Critical for tracing bugs (e.g., --grep="auth" to find all authentication-related changes).

7. --author=<name>

• Definition: Filters commits by author.
• Production insight: When you need to blame someone (or thank them) for a change.

8. --since / --until

• Definition: Filters commits by date range (e.g., --since="2 weeks ago").
• Production insight: Essential for incident postmortems ("What changed in the last 24 hours?").

9. git reflog

• Definition: Shows a log of all Git actions (commits, checkouts, resets, merges) in your local repo.
• Production insight: This is your last line of defense when you git reset --hard or delete a branch. reflog can recover lost commits that git log won’t show.

10. git show <commit>

• Definition: Shows details (message, diff) of a single commit.
• Production insight: When you find a suspicious commit with git log, use git show to inspect it in depth.

3. Step-by-Step Hands-On

Prerequisites

• A Git repo (clone one if you don’t have one): bash git clone https://github.com/your-username/your-repo.git cd your-repo
• Basic Git knowledge (you know git commit, git branch, git checkout).

Task 1: Find When a Bug Was Introduced

Scenario: A test starts failing in CI. You suspect it’s related to a recent change in auth.js.

Step 1: List recent commits (condensed)

git log --oneline -n 10

Output:

a1b2c3d (HEAD -> main) fix: typo in login form
e4f5g6h feat: add OAuth support
i7j8k9l refactor: extract auth logic
...

Step 2: Search for commits touching auth.js

git log --oneline -- auth.js

Output:

e4f5g6h feat: add OAuth support
i7j8k9l refactor: extract auth logic

Step 3: Inspect the suspicious commit

git show e4f5g6h

Output:

commit e4f5g6h...
Author: Alice <[email protected]>
Date:   Mon Oct 2 10:00:00 2023 +0000

    feat: add OAuth support

diff --git a/auth.js b/auth.js
index abc123..def456 100644
--- a/auth.js
+++ b/auth.js
@@ -10,6 +10,12 @@ function login() {
+   if (useOAuth) {
+     // New OAuth logic
+     return oauthLogin();
+   }
 }

✅ Found it! The bug is in the new OAuth logic.

Task 2: Visualize Branch History

Scenario: You’re debugging a merge conflict. You need to see how feature/login diverged from main.

Step 1: Show the commit graph

git log --oneline --graph --all

Output:

* a1b2c3d (HEAD -> main) fix: typo in login form
| * e4f5g6h (feature/login) feat: add OAuth support
| * i7j8k9l refactor: extract auth logic
|/
* d3e2f1g chore: update dependencies

? Insight: feature/login branched off after d3e2f1g and has 2 new commits.

Step 2: Compare branches

git log main..feature/login --oneline

Output:

e4f5g6h feat: add OAuth support
i7j8k9l refactor: extract auth logic

Task 3: Recover a Deleted Branch

Scenario: You accidentally deleted feature/login and need to restore it.

Step 1: Check reflog for the lost branch

git reflog

Output:

a1b2c3d (HEAD -> main) HEAD@{0}: checkout: moving from feature/login to main
e4f5g6h (feature/login) HEAD@{1}: commit: feat: add OAuth support
i7j8k9l HEAD@{2}: checkout: moving from main to feature/login
...

Step 2: Restore the branch

git branch feature/login e4f5g6h

✅ Done! The branch is back.

Task 4: Audit Changes in a File

Scenario: Security asks, "Who modified config/secrets.yml in the last month?"

Step 1: List all changes to the file

git log --oneline --since="1 month ago" -- config/secrets.yml

Output:

a1b2c3d (HEAD -> main) fix: rotate API keys
e4f5g6h feat: add AWS credentials

Step 2: Show the full diff of a suspicious commit

git show a1b2c3d

Output:

commit a1b2c3d...
Author: Bob <[email protected]>
Date:   Tue Oct 3 14:00:00 2023 +0000

    fix: rotate API keys

diff --git a/config/secrets.yml b/config/secrets.yml
index 123abc..456def 100644
--- a/config/secrets.yml
+++ b/config/secrets.yml
@@ -1,3 +1,3 @@
 api_key: "old_key_123"
-db_password: "password123"
+db_password: "new_password_456"

? Insight: Bob rotated the DB password (good), but the old key is still in the history (bad—this is a security risk).

4. ? Production-Ready Best Practices

Security

• Never commit secrets (even in history). Use git filter-repo to purge sensitive data.
• Audit reflog regularly—it can expose deleted branches with sensitive code.
• Use --no-merges when reviewing PRs to avoid hiding changes in merge commits.

Cost Optimization (Yes, Git has costs!)

• Shallow clones (--depth=1) save bandwidth and disk space for CI/CD.
• Prune old branches to reduce repo size: bash git remote prune origin git gc --aggressive

Reliability & Maintainability

• Enforce descriptive commit messages (use Conventional Commits).
• Tag releases (git tag -a v1.0 -m "Release v1.0").
• Use git log --first-parent to see the "main" history (ignoring merge commits).

Observability

• Monitor git log in CI to detect unexpected changes (e.g., git log --since="1 hour ago" | grep -v "CI").
• Log reflog actions in sensitive repos (e.g., git reflog show --date=iso).

5. ⚠️ Common Mistakes & Traps

6. ? Exam/Certification Focus

Typical Question Patterns

1. "How do you find the commit that introduced a bug?"
2. Answer: git log -p -- <file> + git bisect (advanced).

3. Trap: git log alone won’t show the diff—you need -p.

4. "How do you recover a deleted branch?"

5. Answer: git reflog + git branch <name> <commit>.

6. Trap: git log won’t show deleted branches—only reflog will.

7. "How do you visualize branch history?"

8. Answer: git log --oneline --graph --all.

9. Trap: --graph is required to see merges.

10. "How do you filter commits by author?"

11. Answer: git log --author="Alice".

12. Trap: --grep searches messages, not authors.

13. "How do you see what changed in the last week?"

14. Answer: git log --since="1 week ago" --stat.
15. Trap: --since uses relative dates (e.g., "2 days ago"), not absolute.

7. ? Hands-On Challenge

Challenge:
You’re reviewing a PR and notice a suspicious commit (abc123) with the message "fix: typo". The diff is 300 lines long. How do you: 1. See only the changes in this commit (no noise)? 2. Find who approved this commit in GitHub?

Solution:
1. git show abc123 (shows the full diff).
2. Check GitHub’s PR timeline or run git log --pretty=format:"%h %an %s" | grep abc123 to see the author.

Why it works:
- git show gives the exact diff of a commit.
- GitHub’s UI (or git log --pretty=format) reveals the author.

8. ? Rapid-Reference Crib Sheet

9. ? Where to Go Next

1. Official Git log Documentation
2. Git reflog Deep Dive
3. Interactive Git History Visualization (GitKraken)
4. Conventional Commits (Standardized Commit Messages)
5. Git filter-repo (Purge Sensitive Data)

Final Pro Tip

Alias your most-used git log commands in ~/.gitconfig:

[alias]
    lg = log --oneline --graph --all
    lga = log --oneline --graph --all --author="$(git config user.email)"
    lgs = log --oneline --stat
    lgp = log -p

Now you can run git lg instead of typing the full command. Save keystrokes, save time.