NAME
lastcomm —
show last commands executed in reverse
order
SYNOPSIS
lastcomm |
[-f file]
[command ...] [user ...]
[terminal ...] |
DESCRIPTION
lastcomm gives information on previously
executed commands. With no arguments, lastcomm
prints information about all the commands recorded during the current
accounting file's lifetime.
The options are as follows:
-ffile- Read from file rather than the default accounting file.
If called with arguments, only accounting entries with a matching command name, user name, or terminal name are printed. So, for example:
lastcomm a.out root
ttyd0would produce a listing of all the executions of commands named a.out by user root on the terminal ttyd0.
For each process entry, the following are printed:
- Name of the user who ran the process.
- Flags, as accumulated by the system's accounting facilities.
- Command name under which the process was called.
- Amount of CPU time used by the process (in seconds).
- Time the process started.
- Elapsed time of the process.
The flags are encoded as follows:
B- The command executed an indirect branch to a location that did not start
with a ‘
BTI’ instruction, and terminated with signalSIGILL, codeILL_BTCFI. D- The command terminated with the generation of a core file.
F- The command ran after a fork, but without a following execve(2).
M- The command did a system call from writable memory or the stack pointer was not in stack memory.
P- The command was terminated due to a pledge(2) violation.
S- The command tried to execute a system call from the wrong system call instruction, see pinsyscalls(2).
T- The command did a memory access violation detected by a processor trap.
U- The command tried a file access that was prevented by unveil(2).
X- The command was terminated with a signal.
FILES
- /var/account/acct
- default accounting file
SEE ALSO
HISTORY
The lastcomm command appeared in
3.0BSD.