---
name: "lastcomm"
section: "1"
platform: "openbsd"
package: "man"
version: "8.0-current-20261101"
release: "OpenBSD 8.0-current (2026-11-01)"
platforms: ["linux", "freebsd", "openbsd", "macos"]
url: "https://new.carta.tech/lastcomm"
---

# lastcomm(1)

show last commands executed in reverse order

## NAME

**lastcomm** – show last commands executed in reverse order

## SYNOPSIS

**lastcomm** \[**-f** *file*\] \[*command* *...*\] \[*user* *...*\] \[*terminal* *...*\]

## DESCRIPTION

**lastcomm** gives information on previously executed commands. With no arguments, **lastcomm** prints information about all the commands recorded during the current accounting file's lifetime.

The options are as follows:

- **-f** *file*

  Read from *file* rather than the default accounting file.

If called with arguments, only accounting entries with a matching *command* name, *user* name, or *terminal* name are printed. So, for example:

```
lastcomm a.out root ttyd0
```

would produce a listing of all the executions of commands named *a.out* by user *root* on the terminal *ttyd0*.

For each process entry, the following are printed:

- Name of the user who ran the process.

- Flags, as accumulated by the system's accounting facilities.

- Command name under which the process was called.

- Amount of CPU time used by the process (in seconds).

- Time the process started.

- Elapsed time of the process.

The flags are encoded as follows:

- B

  The command executed an indirect branch to a location that did not start with a ‘BTI’ instruction, and terminated with signal SIGILL, *code* ILL\_BTCFI.

- D

  The command terminated with the generation of a *core* file.

- F

  The command ran after a fork, but without a following [execve(2)](/execve/2.md).

- M

  The command did a system call from writable memory or the stack pointer was not in stack memory.

- P

  The command was terminated due to a pledge(2) violation.

- S

  The command tried to execute a system call from the wrong system call instruction, see pinsyscalls(2).

- T

  The command did a memory access violation detected by a processor trap.

- U

  The command tried a file access that was prevented by unveil(2).

- X

  The command was terminated with a signal.

## FILES

- */var/account/acct*

  default accounting file

## SEE ALSO

[last(1)](/last/1.md), [signal(3)](/signal/3.md), [acct(5)](/acct/5.md), [core(5)](/core/5.md), [accton(8)](/accton/8.md)

## HISTORY

The **lastcomm** command appeared in 3.0BSD.