1.\" Copyright (c) 1980, 1990, 1993 2.\" The Regents of the University of California. All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. 9.\" 2. Redistributions in binary form must reproduce the above copyright 10.\" notice, this list of conditions and the following disclaimer in the 11.\" documentation and/or other materials provided with the distribution. 12.\" 3. Neither the name of the University nor the names of its contributors 13.\" may be used to endorse or promote products derived from this software 14.\" without specific prior written permission. 15.\" 16.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 17.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 20.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26.\" SUCH DAMAGE. 27.\" 28.\" From: @(#)lastcomm.1 8.1 (Berkeley) 6/6/93 29.\" $FreeBSD: src/usr.bin/lastcomm/lastcomm.1,v 1.13.8.1 2007/04/18 05:53:50 dds Exp $ 30.\" 31.Dd June 14, 2009 32.Dt LASTCOMM 1 33.Os 34.Sh NAME 35.Nm lastcomm 36.Nd show last commands executed 37.Sh SYNOPSIS 38.Nm 39.Op Fl EScesu 40.Op Fl f Ar file 41.Op Ar command ...\& 42.Op Ar user ...\& 43.Op Ar terminal ...\& 44.Sh DESCRIPTION 45The 46.Nm 47utility gives information on previously executed commands. 48With no arguments, 49.Nm 50prints information about all the commands recorded 51during the current accounting file's lifetime. 52.Pp 53The following options are available: 54.Bl -tag -width indent 55.It Fl E 56Print the time the process exited. 57.It Fl S 58Print the time the process started. 59.It Fl c 60Print the amount of cpu time used by the process. 61.It Fl e 62Print the amount of elapsed time used by the process. 63.It Fl s 64Print the amount of system time used by the process. 65.It Fl u 66Print the amount of user time used by the process. 67.It Fl f Ar file 68Read from 69.Ar file 70rather than the default 71.Pa /var/account/acct . 72If 73.Ar file 74is a single dash 75.Pq Sq \&- 76.Nm 77reads accounting entries from the standard input. 78.El 79.Pp 80If no options are specified, 81.Fl cS 82is assumed. 83If 84.Nm 85is invoked with arguments, only accounting entries with a 86matching 87.Ar command 88name, 89.Ar user 90name, 91or 92.Ar terminal 93name 94are printed. 95For example: 96.Pp 97.Dl lastcomm a.out root ttyd0 98.Pp 99would produce a listing of all the 100executions of commands named 101.Pa a.out 102by user 103.Ar root 104on the terminal 105.Ar ttyd0 . 106.Pp 107For each process entry, the following are printed. 108.Pp 109.Bl -bullet -offset indent -compact 110.It 111The name of the user who ran the process. 112.It 113Flags, as accumulated by the accounting facilities in the system. 114.It 115The command name under which the process was called. 116.It 117The amount of 118CPU 119.Pq Fl c , 120wall 121.Pq Fl e , 122system 123.Pq Fl s , 124or user 125.Pq Fl u 126time used by the process (in seconds). 127.It 128The time the process started 129.Pq Fl S 130or exited 131.Pq Fl E . 132.El 133.Pp 134The flags are encoded as follows: ``S'' indicates the command was 135executed by the super-user, ``F'' indicates the command ran after 136a fork, but without a following 137.Xr exec 3 , 138.\" ``C'' indicates the command was run in PDP-11 compatibility mode 139.\" (VAX only), 140``D'' indicates the command terminated with the generation of a 141.Pa core 142file, and ``X'' indicates the command was terminated with a signal. 143.Pp 144By default, accounting entries are printed going backwards in time, 145starting from the time 146.Nm 147was executed. 148However, if 149.Nm 150reads entries from its standard input, then entries are printed in 151the order they are read. 152.Sh FILES 153.Bl -tag -width /var/account/acct -compact 154.It Pa /var/account/acct 155default accounting file 156.El 157.Sh EXAMPLES 158The command 159.Dl lastcomm -Ee 160will print the exit time and elapsed time of each command logged in 161.Pa /var/account/acct , 162while 163.Dl tail -f -c 0 /var/account/acct | lastcomm -f - 164will print details of each terminating command. 165.Sh SEE ALSO 166.Xr last 1 , 167.Xr sigaction 2 , 168.Xr acct 5 , 169.Xr core 5 170.Sh HISTORY 171The 172.Nm 173command appeared in 174.Bx 3.0 . 175