lastcomm better than history and last

By default the history command shows the "last executed command" in the machine. Rather # history and #last command failed to give more information which the #lastcomm provides.

To use the #lastcomm command, we need start the service:

1) bash-3.2# /usr/sbin/acct/startup

2) bash-3.2# lastcomm
bsh          S     root     pts/0      0.03 secs Tue Dec 13 08:15
bsh          S     root     pts/0      0.02 secs Tue Dec 13 08:15
rm           S     root     pts/0      0.01 secs Tue Dec 13 08:15
rm           S     root     pts/0      0.01 secs Tue Dec 13 08:15
rm           S     root     pts/0      0.01 secs Tue Dec 13 08:15
rm           S     root     pts/0      0.01 secs Tue Dec 13 08:15
rm           S     root     pts/0      0.01 secs Tue Dec 13 08:15
rm           S     root     pts/0      0.01 secs Tue Dec 13 08:15
bsh          S     root     pts/0      0.01 secs Tue Dec 13 08:15
accton       S     root     pts/0      0.01 secs Tue Dec 13 08:15
1st col : Command executed.
2nd col: Command executed by whom. S:root
3rd col: Owner of the command.
4th col: Terminal.
5th col: Execution time of the command.
6th col: Date and Time.

3) bash-3.2# who
root        pts/0       Dec 13 06:20     (ABTS-TN-Static-067.62.165.122.airtelbroadband.in)
root        pts/1       Dec 13 06:24     (122.248.161.91)
root        pts/2       Dec 13 08:05     (ABTS-TN-Static-102.64.165.122.airtelbroadband.in)
root        pts/3       Dec 13 08:18     (122.165.62.67)
root        pts/4       Dec 13 07:16     (122.248.161.91)
4) bash-3.2# lastcomm root pts/3 : List the command executed by a root user on the terminal pts/3
tty          S     root     pts/3      0.01 secs Tue Dec 13 08:18
sar          S     root     pts/3      0.01 secs Tue Dec 13 08:18
sadc         S     root     pts/3      0.14 secs Tue Dec 13 08:18
5) bash-3.2# lastcomm root : List all the commands executed by the root user.
lastcomm     S     root     pts/0      0.03 secs Tue Dec 13 08:19
lastcomm     S     root     pts/0      0.03 secs Tue Dec 13 08:19
lastcomm     S     root     pts/0      0.03 secs Tue Dec 13 08:19
lastcomm     S     root     pts/0      0.03 secs Tue Dec 13 08:19
nfssync_kpro    DX root     __         0.01 secs Tue Dec 13 08:18
who          S     root     pts/0      0.01 secs Tue Dec 13 08:18
tty          S     root     pts/3      0.01 secs Tue Dec 13 08:18
lastcomm     S     root     pts/0      0.03 secs Tue Dec 13 08:18
sar          S     root     pts/3      0.01 secs Tue Dec 13 08:18
sadc         S     root     pts/3      0.14 secs Tue Dec 13 08:18
sar          S     root     pts/3      0.01 secs Tue Dec 13 08:18
termdef      S     root     pts/3      0.01 secs Tue Dec 13 08:18
setmaps      S     root     pts/3      0.01 secs Tue Dec 13 08:18
tty          S     root     pts/0      0.01 secs Tue Dec 13 08:18
lastcomm     S     root     pts/0      0.02 secs Tue Dec 13 08:18
nfssync_kpro    DX root     __         0.01 secs Tue Dec 13 08:17
lastcomm     S     root     pts/0      0.02 secs Tue Dec 13 08:17
clear        S     root     pts/0      0.01 secs Tue Dec 13 08:17
file         S     root     pts/0      0.02 secs Tue Dec 13 08:17
more         S     root     pts/0      0.01 secs Tue Dec 13 08:17
ls           S     root     pts/0      0.03 secs Tue Dec 13 08:17
nfssync_kpro    DX root     __         0.01 secs Tue Dec 13 08:16
nfssync_kpro    DX root     __         0.01 secs Tue Dec 13 08:15
lastcomm     S     root     pts/0      0.02 secs Tue Dec 13 08:15
bsh          S     root     pts/0      0.03 secs Tue Dec 13 08:15
bsh          S     root     pts/0      0.02 secs Tue Dec 13 08:15
rm           S     root     pts/0      0.01 secs Tue Dec 13 08:15
rm           S     root     pts/0      0.01 secs Tue Dec 13 08:15
rm           S     root     pts/0      0.01 secs Tue Dec 13 08:15
rm           S     root     pts/0      0.01 secs Tue Dec 13 08:15
rm           S     root     pts/0      0.01 secs Tue Dec 13 08:15
rm           S     root     pts/0      0.01 secs Tue Dec 13 08:15
bsh          S     root     pts/0      0.01 secs Tue Dec 13 08:15
accton       S     root     pts/0      0.01 secs Tue Dec 13 08:15
6) bash-3.2# date
Tue Dec 13 08:22:09 CST 2011
bash-3.2# lastcomm date : Shows when the date command was executed.
date         S     root     pts/0      0.01 secs Tue Dec 13 08:22

              S  The root user executed the command.
              F  The command ran after a fork, but without a following subroutine.
              C  The command ran in PDP-11 compatibility mode.
              D  The command terminated with the generation of a core file.
              X  The command was terminated with a signal.