1.\" Copyright (c) 1980, 1990, 1993 2.\" The Regents of the University of California. All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. 9.\" 2. Redistributions in binary form must reproduce the above copyright 10.\" notice, this list of conditions and the following disclaimer in the 11.\" documentation and/or other materials provided with the distribution. 12.\" 3. Neither the name of the University nor the names of its contributors 13.\" may be used to endorse or promote products derived from this software 14.\" without specific prior written permission. 15.\" 16.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 17.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 20.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26.\" SUCH DAMAGE. 27.\" 28.Dd May 17, 2012 29.Dt LASTCOMM 1 30.Os 31.Sh NAME 32.Nm lastcomm 33.Nd show last commands executed 34.Sh SYNOPSIS 35.Nm 36.Op Fl EScesu 37.Op Fl f Ar file 38.Op Cm + Ns Ar format 39.Op Ar command ...\& 40.Op Ar user ...\& 41.Op Ar terminal ...\& 42.Sh DESCRIPTION 43The 44.Nm 45utility gives information on previously executed commands. 46With no arguments, 47.Nm 48prints information about all the commands recorded 49during the current accounting file's lifetime. 50.Pp 51The following options are available: 52.Bl -tag -width indent 53.It Fl E 54Print the time the process exited. 55.It Fl S 56Print the time the process started. 57.It Fl c 58Print the amount of cpu time used by the process. 59.It Fl e 60Print the amount of elapsed time used by the process. 61.It Fl s 62Print the amount of system time used by the process. 63.It Fl u 64Print the amount of user time used by the process. 65.It Fl f Ar file 66Read from 67.Ar file 68rather than the default 69.Pa /var/account/acct . 70If 71.Ar file 72is a single dash 73.Pq Sq \&- 74.Nm 75reads accounting entries from the standard input. 76.El 77.Pp 78An operand with a leading plus sign 79.Pq Sq + 80is followed a user-defined format string which specifies the format 81in which to display the process's start or exit date and time. 82The format string may contain any of the conversion specifications 83described in the 84.Xr strftime 3 85manual page, as well as arbitrary text. 86.Pp 87If no options are specified, 88.Fl cS 89is assumed. 90If 91.Nm 92is invoked with arguments, only accounting entries with a 93matching 94.Ar command 95name, 96.Ar user 97name, 98or 99.Ar terminal 100name 101are printed. 102For example: 103.Pp 104.Dl lastcomm a.out root ttyd0 105.Pp 106would produce a listing of all the 107executions of commands named 108.Pa a.out 109by user 110.Ar root 111on the terminal 112.Ar ttyd0 . 113.Pp 114For each process entry, the following are printed. 115.Pp 116.Bl -bullet -offset indent -compact 117.It 118The name of the user who ran the process. 119.It 120Flags, as accumulated by the accounting facilities in the system. 121.It 122The command name under which the process was called. 123.It 124The amount of 125CPU 126.Pq Fl c , 127wall 128.Pq Fl e , 129system 130.Pq Fl s , 131or user 132.Pq Fl u 133time used by the process (in seconds). 134.It 135The time the process started 136.Pq Fl S 137or exited 138.Pq Fl E . 139.El 140.Pp 141The flags are encoded as follows: ``S'' indicates the command was 142executed by the super-user, ``F'' indicates the command ran after 143a fork, but without a following 144.Xr exec 3 , 145.\" ``C'' indicates the command was run in PDP-11 compatibility mode 146.\" (VAX only), 147``D'' indicates the command terminated with the generation of a 148.Pa core 149file, and ``X'' indicates the command was terminated with a signal. 150.Pp 151By default, accounting entries are printed going backwards in time, 152starting from the time 153.Nm 154was executed. 155However, if 156.Nm 157reads entries from its standard input, then entries are printed in 158the order they are read. 159.Sh FILES 160.Bl -tag -width /var/account/acct -compact 161.It Pa /var/account/acct 162default accounting file 163.El 164.Sh EXAMPLES 165The command 166.Dl lastcomm -Ee 167will print the exit time and elapsed time of each command logged in 168.Pa /var/account/acct , 169while 170.Dl tail -f -c 0 /var/account/acct | lastcomm -f - 171will print details of each terminating command. 172.Sh SEE ALSO 173.Xr last 1 , 174.Xr sigaction 2 , 175.Xr strftime 3 , 176.Xr acct 5 , 177.Xr core 5 178.Sh HISTORY 179The 180.Nm 181command appeared in 182.Bx 3.0 . 183