LASTCOMM(1)

NAME
lastcomm - show last commands executed in reverse order

SYNOPSIS
lastcomm [-f file] [command ...] [user ...] [terminal ...]

DESCRIPTION
lastcomm gives information on previously executed commands. With no arguments, lastcomm prints information about all the commands recorded during the current accounting file's lifetime.

The options are as follows:

-f file
    Read from file rather than the default accounting file.

If called with arguments, only accounting entries with a matching command name, user name, or terminal name are printed. So, for example:

    lastcomm a.out root ttyd0

would produce a listing of all the executions of commands named a.out by user root on the terminal ttyd0.

For each process entry, the following are printed:

•   Name of the user who ran the process.
•   Flags, as accumulated by the system's accounting facilities.
•   Command name under which the process was called.
•   Amount of CPU time used by the process (in seconds).
•   Time the process started.
•   Elapsed time of the process.

The flags are encoded as follows: ‘S’ indicates the command was executed by the superuser, ‘F’ indicates the command ran after a fork, but without a following exec(3), ‘C’ indicates the command was run in PDP-11 compatibility mode (VAX only), ‘D’ indicates the command terminated with the generation of a core file, and ‘X’ indicates the command was terminated with a signal.

FILES
/var/account/acct
    default accounting file

SEE ALSO
last(1), sigvec(3), acct(5), core(5), accton(8)

HISTORY
The lastcomm command appeared in 3.0BSD.