Red Hat Knowledgebase

Red Hat Enterprise Linux provides several ways to display which commands were run before the server reboots; psasct and lastcomm. Lastcomm prints out information about previously executed commands. If no arguments are specified, lastcomm will print info about all of the commands in acct (the record file).

First, please make sure the package psacct is installed:

# rpm -q psacct-6.3.2-39.rhel4

The main purpose is to mornitor process activities, including ac, lastcomm, accton and sa.

If the package is installed, please enable psacct by running:

# service psacct start
# chkconfig psacct on

Now lastcomm can list the commands that have run, for example:

# lastcomm

The output is similar as below:

rpmq root pts/1 0.04 secs Wed Feb 27 18:35
rpmq root pts/1 0.04 secs Wed Feb 27 18:35
rpmq root pts/1 0.04 secs Wed Feb 27 18:35
man root pts/1 0.01 secs Wed Feb 27 18:33
sh root pts/1 0.00 secs Wed Feb 27 18:33
sh root pts/1 0.01 secs Wed Feb 27 18:33
less root pts/1 0.01 secs Wed Feb 27 18:33
nroff root pts/1 0.02 secs Wed Feb 27 18:33
rm root pts/1 0.00 secs Wed Feb 27 18:33
rm root pts/1 0.00 secs Wed Feb 27 18:33