Manual Page Search Parameters
LASTCOMM(1) General Commands Manual LASTCOMM(1)

lastcomm — show last commands executed in reverse order

lastcomm [-f file] [command ...] [user ...] [terminal ...]

lastcomm gives information on previously executed commands. With no arguments, lastcomm prints information about all the commands recorded during the current accounting file's lifetime.

The options are as follows:

file
Read from file rather than the default accounting file.

If called with arguments, only accounting entries with a matching command name, user name, or terminal name are printed. So, for example:

lastcomm a.out root ttyd0

would produce a listing of all the executions of commands named a.out by user root on the terminal ttyd0.

For each process entry, the following are printed:

The flags are encoded as follows:

The command executed an indirect branch to a location that did not start with a ‘BTI’ instruction, and terminated with signal SIGILL, code ILL_BTCFI.
The command terminated with the generation of a core file.
The command ran after a fork, but without a following execve(2).
The command did a system call from writable memory or the stack pointer was not in stack memory.
The command was terminated due to a pledge(2) violation.
The command tried to execute a system call from the wrong system call instruction, see pinsyscalls(2).
The command did a memory access violation detected by a processor trap.
The command tried a file access that was prevented by unveil(2).
The command was terminated with a signal.

/var/account/acct
default accounting file

last(1), sigaction(2), acct(5), core(5), accton(8)

The lastcomm command appeared in 3.0BSD.

February 25, 2024 openbsd