1.\" Copyright (c) 1980, 1990, 1993 2.\" The Regents of the University of California. All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. 9.\" 2. Redistributions in binary form must reproduce the above copyright 10.\" notice, this list of conditions and the following disclaimer in the 11.\" documentation and/or other materials provided with the distribution. 12.\" 3. Neither the name of the University nor the names of its contributors 13.\" may be used to endorse or promote products derived from this software 14.\" without specific prior written permission. 15.\" 16.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 17.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 20.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26.\" SUCH DAMAGE. 27.\" 28.\" From: @(#)lastcomm.1 8.1 (Berkeley) 6/6/93 29.\" $FreeBSD$ 30.\" 31.Dd May 17, 2012 32.Dt LASTCOMM 1 33.Os 34.Sh NAME 35.Nm lastcomm 36.Nd show last commands executed 37.Sh SYNOPSIS 38.Nm 39.Op Fl EScesu 40.Op Fl f Ar file 41.Op Cm + Ns Ar format 42.Op Ar command ...\& 43.Op Ar user ...\& 44.Op Ar terminal ...\& 45.Sh DESCRIPTION 46The 47.Nm 48utility gives information on previously executed commands. 49With no arguments, 50.Nm 51prints information about all the commands recorded 52during the current accounting file's lifetime. 53.Pp 54The following options are available: 55.Bl -tag -width indent 56.It Fl E 57Print the time the process exited. 58.It Fl S 59Print the time the process started. 60.It Fl c 61Print the amount of cpu time used by the process. 62.It Fl e 63Print the amount of elapsed time used by the process. 64.It Fl s 65Print the amount of system time used by the process. 66.It Fl u 67Print the amount of user time used by the process. 68.It Fl f Ar file 69Read from 70.Ar file 71rather than the default 72.Pa /var/account/acct . 73If 74.Ar file 75is a single dash 76.Pq Sq \&- 77.Nm 78reads accounting entries from the standard input. 79.El 80.Pp 81An operand with a leading plus sign 82.Pq Sq + 83is followed a user-defined format string which specifies the format 84in which to display the process's start or exit date and time. 85The format string may contain any of the conversion specifications 86described in the 87.Xr strftime 3 88manual page, as well as arbitrary text. 89.Pp 90If no options are specified, 91.Fl cS 92is assumed. 93If 94.Nm 95is invoked with arguments, only accounting entries with a 96matching 97.Ar command 98name, 99.Ar user 100name, 101or 102.Ar terminal 103name 104are printed. 105For example: 106.Pp 107.Dl lastcomm a.out root ttyd0 108.Pp 109would produce a listing of all the 110executions of commands named 111.Pa a.out 112by user 113.Ar root 114on the terminal 115.Ar ttyd0 . 116.Pp 117For each process entry, the following are printed. 118.Pp 119.Bl -bullet -offset indent -compact 120.It 121The name of the user who ran the process. 122.It 123Flags, as accumulated by the accounting facilities in the system. 124.It 125The command name under which the process was called. 126.It 127The amount of 128CPU 129.Pq Fl c , 130wall 131.Pq Fl e , 132system 133.Pq Fl s , 134or user 135.Pq Fl u 136time used by the process (in seconds). 137.It 138The time the process started 139.Pq Fl S 140or exited 141.Pq Fl E . 142.El 143.Pp 144The flags are encoded as follows: ``S'' indicates the command was 145executed by the super-user, ``F'' indicates the command ran after 146a fork, but without a following 147.Xr exec 3 , 148.\" ``C'' indicates the command was run in PDP-11 compatibility mode 149.\" (VAX only), 150``D'' indicates the command terminated with the generation of a 151.Pa core 152file, and ``X'' indicates the command was terminated with a signal. 153.Pp 154By default, accounting entries are printed going backwards in time, 155starting from the time 156.Nm 157was executed. 158However, if 159.Nm 160reads entries from its standard input, then entries are printed in 161the order they are read. 162.Sh FILES 163.Bl -tag -width /var/account/acct -compact 164.It Pa /var/account/acct 165default accounting file 166.El 167.Sh EXAMPLES 168The command 169.Dl lastcomm -Ee 170will print the exit time and elapsed time of each command logged in 171.Pa /var/account/acct , 172while 173.Dl tail -f -c 0 /var/account/acct | lastcomm -f - 174will print details of each terminating command. 175.Sh SEE ALSO 176.Xr last 1 , 177.Xr sigaction 2 , 178.Xr strftime 3 , 179.Xr acct 5 , 180.Xr core 5 181.Sh HISTORY 182The 183.Nm 184command appeared in 185.Bx 3.0 . 186