Manual Page Search Parameters

LASTCOMM(1) General Commands Manual LASTCOMM(1)


lastcommshow last commands executed in reverse order


lastcomm [-f file] [command ...] [user ...] [terminal ...]


lastcomm gives information on previously executed commands. With no arguments, lastcomm prints information about all the commands recorded during the current accounting file's lifetime.
The options are as follows:
-f file
Read from file rather than the default accounting file.
If called with arguments, only accounting entries with a matching command name, user name, or terminal name are printed. So, for example:
lastcomm a.out root ttyd0
would produce a listing of all the executions of commands named a.out by user root on the terminal ttyd0.
For each process entry, the following are printed:
The flags are encoded as follows: ‘S’ indicates the command was executed by the superuser, ‘F’ indicates the command ran after a fork, but without a following exec(3), ‘C’ indicates the command was run in PDP-11 compatibility mode (VAX only), ‘D’ indicates the command terminated with the generation of a core file, ‘X’ indicates the command was terminated with a signal, ‘P’ indicates the command was terminated due to a pledge(2) violation, and ‘T’ indicates the command did a memory access violation detected by a processor trap.


default accounting file


last(1), sigvec(3), acct(5), core(5), accton(8)


The lastcomm command appeared in 3.0BSD.
June 8, 2017 OpenBSD-current