1.\" $OpenBSD: lastcomm.1,v 1.28 2024/02/25 00:07:13 deraadt Exp $ 2.\" $NetBSD: lastcomm.1,v 1.5 1995/10/22 01:43:41 ghudson Exp $ 3.\" 4.\" Copyright (c) 1980, 1990, 1993 5.\" The Regents of the University of California. All rights reserved. 6.\" 7.\" Redistribution and use in source and binary forms, with or without 8.\" modification, are permitted provided that the following conditions 9.\" are met: 10.\" 1. Redistributions of source code must retain the above copyright 11.\" notice, this list of conditions and the following disclaimer. 12.\" 2. Redistributions in binary form must reproduce the above copyright 13.\" notice, this list of conditions and the following disclaimer in the 14.\" documentation and/or other materials provided with the distribution. 15.\" 3. Neither the name of the University nor the names of its contributors 16.\" may be used to endorse or promote products derived from this software 17.\" without specific prior written permission. 18.\" 19.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 20.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 23.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29.\" SUCH DAMAGE. 30.\" 31.\" @(#)lastcomm.1 8.1 (Berkeley) 6/6/93 32.\" 33.Dd $Mdocdate: February 25 2024 $ 34.Dt LASTCOMM 1 35.Os 36.Sh NAME 37.Nm lastcomm 38.Nd show last commands executed in reverse order 39.Sh SYNOPSIS 40.Nm lastcomm 41.Op Fl f Ar file 42.Op Ar command ... 43.Op Ar user ... 44.Op Ar terminal ... 45.Sh DESCRIPTION 46.Nm lastcomm 47gives information on previously executed commands. 48With no arguments, 49.Nm lastcomm 50prints information about all the commands recorded 51during the current accounting file's lifetime. 52.Pp 53The options are as follows: 54.Bl -tag -width Ds 55.It Fl f Ar file 56Read from 57.Ar file 58rather than the default 59accounting file. 60.El 61.Pp 62If called with arguments, only accounting entries with a 63matching 64.Ar command 65name, 66.Ar user 67name, 68or 69.Ar terminal 70name 71are printed. 72So, for example: 73.Pp 74.Dl lastcomm a.out root ttyd0 75.Pp 76would produce a listing of all the 77executions of commands named 78.Pa a.out 79by user 80.Ar root 81on the terminal 82.Ar ttyd0 . 83.Pp 84For each process entry, the following are printed: 85.Pp 86.Bl -bullet -offset indent -compact 87.It 88Name of the user who ran the process. 89.It 90Flags, as accumulated by the system's accounting facilities. 91.It 92Command name under which the process was called. 93.It 94Amount of CPU time used by the process (in seconds). 95.It 96Time the process started. 97.It 98Elapsed time of the process. 99.El 100.Pp 101The flags are encoded as follows: 102.Pp 103.Bl -tag -width 6n -compact -offset indent 104.It Li B 105The command executed an indirect branch to a location that did not 106start with a 107.Ql BTI 108instruction, and terminated with signal 109.Dv SIGILL , 110.Va code 111.Dv ILL_BTCFI . 112.It Li D 113The command terminated with the generation of a 114.Pa core 115file. 116.It Li F 117The command ran after 118a fork, but without a following 119.Xr execve 2 . 120.It Li M 121The command did a system call from writable memory or the stack 122pointer was not in stack memory. 123.It Li P 124The command was terminated due to a 125.Xr pledge 2 126violation. 127.It Li S 128The command tried to execute a system call from the wrong 129system call instruction, see 130.Xr pinsyscalls 2 . 131.It Li T 132The command did a memory access violation detected by a 133processor trap. 134.It Li U 135The command tried a file access that was prevented by 136.Xr unveil 2 . 137.It Li X 138The command was terminated with a signal. 139.El 140.Sh FILES 141.Bl -tag -width /var/account/acct -compact 142.It Pa /var/account/acct 143default accounting file 144.El 145.Sh SEE ALSO 146.Xr last 1 , 147.Xr sigaction 2 , 148.Xr acct 5 , 149.Xr core 5 , 150.Xr accton 8 151.Sh HISTORY 152The 153.Nm lastcomm 154command appeared in 155.Bx 3.0 . 156