LASTCOMM(1) - General Commands Manual #
LASTCOMM(1) - General Commands Manual
NAME #
lastcomm - show last commands executed in reverse order
SYNOPSIS #
lastcomm [-f file] [command …] [user …] [terminal …]
DESCRIPTION #
lastcomm gives information on previously executed commands. With no arguments, lastcomm prints information about all the commands recorded during the current accounting file’s lifetime.
The options are as follows:
-f file
Read from file rather than the default accounting file.
If called with arguments, only accounting entries with a matching command name, user name, or terminal name are printed. So, for example:
lastcomm a.out root ttyd0
would produce a listing of all the executions of commands named a.out by user root on the terminal ttyd0.
For each process entry, the following are printed:
- Name of the user who ran the process.
- Flags, as accumulated by the system’s accounting facilities.
- Command name under which the process was called.
- Amount of CPU time used by the process (in seconds).
- Time the process started.
- Elapsed time of the process.
The flags are encoded as follows:
B
The command executed an indirect branch to a location that did not start with a ‘
BTI’ instruction, and terminated with signalSIGILL, codeILL_BTCFI.
D
The command terminated with the generation of a
*core*
file.
F
The command ran after
a fork, but without a following
execve(2).
M
The command did a system call from writable memory or the stack
pointer was not in stack memory.
P
The command was terminated due to a
pledge(2)
violation.
S
The command tried to execute a system call from the wrong
system call instruction, see
pinsyscalls(2).
T
The command did a memory access violation detected by a
processor trap.
U
The command tried a file access that was prevented by
unveil(2).
X
The command was terminated with a signal.
FILES #
/var/account/acct
default accounting file
SEE ALSO #
last(1), sigaction(2), acct(5), core(5), accton(8)
HISTORY #
The lastcomm command appeared in 3.0BSD.
OpenBSD 7.5 - February 25, 2024