LASTCOMM(1) | General Commands Manual | LASTCOMM(1)

# NAME

`lastcomm` — show last commands executed in reverse order

# SYNOPSIS

`lastcomm` | [`-f` file] [command ...] [user ...] [terminal ...]

# DESCRIPTION

`lastcomm` gives information on previously executed commands. With no arguments, `lastcomm` prints information about all the commands recorded during the current accounting file's lifetime.

The options are as follows:

`-f` file
  Read from file rather than the default accounting file.

If called with arguments, only accounting entries with a matching command name, user name, or terminal name are printed. So, for example:

`lastcomm a.out root ttyd0`

would produce a listing of all the executions of commands named a.out by user root on the terminal ttyd0.

For each process entry, the following are printed:

- Name of the user who ran the process.
- Flags, as accumulated by the system's accounting facilities.
- Command name under which the process was called.
- Amount of CPU time used by the process (in seconds).
- Time the process started.
- Elapsed time of the process.

The flags are encoded as follows:

`B`
  The command executed an indirect branch to a location that did not start with a ‘`BTI`’ instruction, and terminated with signal `SIGILL`, code `ILL_BTCFI`.
`D`
  The command terminated with the generation of a core file.
`F`
  The command ran after a fork, but without a following execve(2).
`M`
  The command did a system call from writable memory or the stack pointer was not in stack memory.
`P`
  The command was terminated due to a pledge(2) violation.
`S`
  The command tried to execute a system call from the wrong system call instruction, see pinsyscalls(2).
`T`
  The command did a memory access violation detected by a processor trap.
`U`
  The command tried a file access that was prevented by unveil(2).
`X`
  The command was terminated with a signal.

# FILES

/var/account/acct
  default accounting file

# SEE ALSO

last(1), signal(3), acct(5), core(5), accton(8)

# HISTORY

The `lastcomm` command appeared in 3.0BSD.

April 22, 2025 | Debian