solaris - lastcomm (1)

     lastcomm - display the last commands  executed,  in  reverse
     order

     lastcomm [ command-name ] ... [ user-name ] ...
          [ terminal-name ] ...

     SUNWesu

     The lastcomm command gives information  on  previously  exe-
     cuted  commands.  lastcomm with no arguments displays infor-
     mation about all the commands recorded  during  the  current
     accounting  file's  lifetime.   If  called  with  arguments,
     lastcomm only displays accounting entries  with  a  matching
     command-name, user-name, or terminal-name.

     If terminal-name is `- -' there was no controlling  TTY  for
     the  process.  The process was probably executed during boot
     time.  If terminal-name is `??', the controlling  TTY  could
     not be decoded into a printable name.

     The command:
          example% lastcomm a.out root term/01

     produces a listing of all the executions of  commands  named
     a.out, by user root while using the terminal term/01.

     The command:
          example% lastcomm root

     produces a listing of all  the  commands  executed  by  user
     root.

     For each process  entry,  lastcomm  displays  the  following
     items of information:

          o   The  command  name  under  which  the  process  was
             called.

          o   One or more flags  indicating  special  information
             about  the  process.   The  flags have the following
             meanings:

               F  The process performed a fork but not an exec.

               S  The process ran as a set-user-id program.

          o   The name of the user who ran the process.
          o   The terminal which the user was logged in on at the
             time (if applicable).

          o   The amount of CPU time  used  by  the  process  (in
             seconds).

          o   The date and time the process exited.

     /var/adm/pacct      accounting file

     last(1), sigvec(3B), acct(4), core(4)