/usr.bin/lastcomm/lastcomm.1

  1.\" Copyright (c) 1980, 1990, 1993
  2.\"	The Regents of the University of California.  All rights reserved.
  3.\"
  4.\" Redistribution and use in source and binary forms, with or without
  5.\" modification, are permitted provided that the following conditions
  6.\" are met:
  7.\" 1. Redistributions of source code must retain the above copyright
  8.\"    notice, this list of conditions and the following disclaimer.
  9.\" 2. Redistributions in binary form must reproduce the above copyright
 10.\"    notice, this list of conditions and the following disclaimer in the
 11.\"    documentation and/or other materials provided with the distribution.
 12.\" 4. Neither the name of the University nor the names of its contributors
 13.\"    may be used to endorse or promote products derived from this software
 14.\"    without specific prior written permission.
 15.\"
 16.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
 17.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 18.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 19.\" ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
 20.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 21.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 22.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 23.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 24.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 25.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 26.\" SUCH DAMAGE.
 27.\"
 28.\"	From: @(#)lastcomm.1	8.1 (Berkeley) 6/6/93
 29.\" $FreeBSD$
 30.\"
 31.Dd May 17, 2012
 32.Dt LASTCOMM 1
 33.Os
 34.Sh NAME
 35.Nm lastcomm
 36.Nd show last commands executed
 37.Sh SYNOPSIS
 38.Nm
 39.Op Fl EScesu
 40.Op Fl f Ar file
 41.Op Cm + Ns Ar format
 42.Op Ar command ...\&
 43.Op Ar user ...\&
 44.Op Ar terminal ...\&
 45.Sh DESCRIPTION
 46The
 47.Nm
 48utility gives information on previously executed commands.
 49With no arguments,
 50.Nm
 51prints information about all the commands recorded
 52during the current accounting file's lifetime.
 53.Pp
 54The following options are available:
 55.Bl -tag -width indent
 56.It Fl E
 57Print the time the process exited.
 58.It Fl S
 59Print the time the process started.
 60.It Fl c
 61Print the amount of cpu time used by the process.
 62.It Fl e
 63Print the amount of elapsed time used by the process.
 64.It Fl s
 65Print the amount of system time used by the process.
 66.It Fl u
 67Print the amount of user time used by the process.
 68.It Fl f Ar file
 69Read from
 70.Ar file
 71rather than the default
 72.Pa /var/account/acct .
 73If
 74.Ar file
 75is a single dash
 76.Pq Sq \&-
 77.Nm
 78reads accounting entries from the standard input.
 79.El
 80.Pp
 81An operand with a leading plus sign
 82.Pq Sq +
 83is followed a user-defined format string which specifies the format
 84in which to display the process's start or exit date and time.
 85The format string may contain any of the conversion specifications
 86described in the
 87.Xr strftime 3
 88manual page, as well as arbitrary text.
 89.Pp
 90If no options are specified,
 91.Fl cS
 92is assumed.
 93If
 94.Nm
 95is invoked with arguments, only accounting entries with a
 96matching
 97.Ar command
 98name,
 99.Ar user
100name,
101or
102.Ar terminal
103name
104are printed.
105For example:
106.Pp
107.Dl lastcomm a.out root ttyd0
108.Pp
109would produce a listing of all the
110executions of commands named
111.Pa a.out
112by user
113.Ar root
114on the terminal
115.Ar ttyd0 .
116.Pp
117For each process entry, the following are printed.
118.Pp
119.Bl -bullet -offset indent -compact
120.It
121The name of the user who ran the process.
122.It
123Flags, as accumulated by the accounting facilities in the system.
124.It
125The command name under which the process was called.
126.It
127The amount of
128CPU
129.Pq Fl c ,
130wall
131.Pq Fl e ,
132system
133.Pq Fl s ,
134or user
135.Pq Fl u
136time used by the process (in seconds).
137.It
138The time the process started
139.Pq Fl S
140or exited
141.Pq Fl E .
142.El
143.Pp
144The flags are encoded as follows: ``S'' indicates the command was
145executed by the super-user, ``F'' indicates the command ran after
146a fork, but without a following
147.Xr exec 3 ,
148.\" ``C'' indicates the command was run in PDP-11 compatibility mode
149.\" (VAX only),
150``D'' indicates the command terminated with the generation of a
151.Pa core
152file, and ``X'' indicates the command was terminated with a signal.
153.Pp
154By default, accounting entries are printed going backwards in time,
155starting from the time
156.Nm
157was executed.
158However, if
159.Nm
160reads entries from its standard input, then entries are printed in
161the order they are read.
162.Sh FILES
163.Bl -tag -width /var/account/acct -compact
164.It Pa /var/account/acct
165default accounting file
166.El
167.Sh EXAMPLES
168The command
169.Dl lastcomm -Ee
170will print the exit time and elapsed time of each command logged in
171.Pa /var/account/acct ,
172while
173.Dl tail -f -c 0 /var/account/acct | lastcomm -f -
174will print details of each terminating command.
175.Sh SEE ALSO
176.Xr last 1 ,
177.Xr sigaction 2 ,
178.Xr strftime 3 ,
179.Xr acct 5 ,
180.Xr core 5
181.Sh HISTORY
182The
183.Nm
184command appeared in
185.Bx 3.0 .