LASTCOMM(1)

NAME
lastcomm - show last commands executed in reverse order

SYNOPSIS
lastcomm [-EScesu] [-f file] [command ...] [user ...] [terminal ...]

DESCRIPTION
Lastcomm gives information on previously executed commands. With no arguments, lastcomm prints information about all the commands recorded during the current accounting file's lifetime.

The following options are available:

-E  Print the time the process exited.
-S  Print the time the process started.
-c  Print the amount of cpu time used by the process.
-e  Print the amount of elapsed time used by the process.
-s  Print the amount of system time used by the process.
-u  Print the amount of user time used by the process.
-f file
    Read from file rather than the default /var/account/acct.

If no options are specified, -cS is assumed. If lastcomm is invoked with arguments, only accounting entries with a matching command name, user name, or terminal name are printed. For example:

    lastcomm a.out root ttyd0

would produce a listing of all the executions of commands named a.out by user root on the terminal ttyd0.

For each process entry, the following are printed.

•   The name of the user who ran the process.
•   Flags, as accumulated by the accounting facilities in the system.
•   The command name under which the process was called.
•   The amount of CPU (-c), wall (-e), system (-s), or user (-u) time used by the process (in seconds).
•   The time the process started (-S) or exited (-E).

The flags are encoded as follows: ``S'' indicates the command was executed by the super-user, ``F'' indicates the command ran after a fork, but without a following exec, ``D'' indicates the command terminated with the generation of a core file, and ``X'' indicates the command was terminated with a signal.

FILES
/var/account/acct
    Default accounting file.

SEE ALSO
last(1), sigvec(2), acct(5), core(5)

HISTORY
The lastcomm command appeared in 3.0BSD.