1.\" Copyright (c) 1980, 1990, 1993 2.\" The Regents of the University of California. All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. 9.\" 2. Redistributions in binary form must reproduce the above copyright 10.\" notice, this list of conditions and the following disclaimer in the 11.\" documentation and/or other materials provided with the distribution. 12.\" 3. Neither the name of the University nor the names of its contributors 13.\" may be used to endorse or promote products derived from this software 14.\" without specific prior written permission. 15.\" 16.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 17.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 20.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26.\" SUCH DAMAGE. 27.\" 28.\" From: @(#)lastcomm.1 8.1 (Berkeley) 6/6/93 29.\" 30.Dd May 17, 2012 31.Dt LASTCOMM 1 32.Os 33.Sh NAME 34.Nm lastcomm 35.Nd show last commands executed 36.Sh SYNOPSIS 37.Nm 38.Op Fl EScesu 39.Op Fl f Ar file 40.Op Cm + Ns Ar format 41.Op Ar command ...\& 42.Op Ar user ...\& 43.Op Ar terminal ...\& 44.Sh DESCRIPTION 45The 46.Nm 47utility gives information on previously executed commands. 48With no arguments, 49.Nm 50prints information about all the commands recorded 51during the current accounting file's lifetime. 52.Pp 53The following options are available: 54.Bl -tag -width indent 55.It Fl E 56Print the time the process exited. 57.It Fl S 58Print the time the process started. 59.It Fl c 60Print the amount of cpu time used by the process. 61.It Fl e 62Print the amount of elapsed time used by the process. 63.It Fl s 64Print the amount of system time used by the process. 65.It Fl u 66Print the amount of user time used by the process. 67.It Fl f Ar file 68Read from 69.Ar file 70rather than the default 71.Pa /var/account/acct . 72If 73.Ar file 74is a single dash 75.Pq Sq \&- 76.Nm 77reads accounting entries from the standard input. 78.El 79.Pp 80An operand with a leading plus sign 81.Pq Sq + 82is followed a user-defined format string which specifies the format 83in which to display the process's start or exit date and time. 84The format string may contain any of the conversion specifications 85described in the 86.Xr strftime 3 87manual page, as well as arbitrary text. 88.Pp 89If no options are specified, 90.Fl cS 91is assumed. 92If 93.Nm 94is invoked with arguments, only accounting entries with a 95matching 96.Ar command 97name, 98.Ar user 99name, 100or 101.Ar terminal 102name 103are printed. 104For example: 105.Pp 106.Dl lastcomm a.out root ttyd0 107.Pp 108would produce a listing of all the 109executions of commands named 110.Pa a.out 111by user 112.Ar root 113on the terminal 114.Ar ttyd0 . 115.Pp 116For each process entry, the following are printed. 117.Pp 118.Bl -bullet -offset indent -compact 119.It 120The name of the user who ran the process. 121.It 122Flags, as accumulated by the accounting facilities in the system. 123.It 124The command name under which the process was called. 125.It 126The amount of 127CPU 128.Pq Fl c , 129wall 130.Pq Fl e , 131system 132.Pq Fl s , 133or user 134.Pq Fl u 135time used by the process (in seconds). 136.It 137The time the process started 138.Pq Fl S 139or exited 140.Pq Fl E . 141.El 142.Pp 143The flags are encoded as follows: ``S'' indicates the command was 144executed by the super-user, ``F'' indicates the command ran after 145a fork, but without a following 146.Xr exec 3 , 147.\" ``C'' indicates the command was run in PDP-11 compatibility mode 148.\" (VAX only), 149``D'' indicates the command terminated with the generation of a 150.Pa core 151file, and ``X'' indicates the command was terminated with a signal. 152.Pp 153By default, accounting entries are printed going backwards in time, 154starting from the time 155.Nm 156was executed. 157However, if 158.Nm 159reads entries from its standard input, then entries are printed in 160the order they are read. 161.Sh FILES 162.Bl -tag -width /var/account/acct -compact 163.It Pa /var/account/acct 164default accounting file 165.El 166.Sh EXAMPLES 167The command 168.Dl lastcomm -Ee 169will print the exit time and elapsed time of each command logged in 170.Pa /var/account/acct , 171while 172.Dl tail -f -c 0 /var/account/acct | lastcomm -f - 173will print details of each terminating command. 174.Sh SEE ALSO 175.Xr last 1 , 176.Xr sigaction 2 , 177.Xr strftime 3 , 178.Xr acct 5 , 179.Xr core 5 180.Sh HISTORY 181The 182.Nm 183command appeared in 184.Bx 3.0 . 185