使用lastcomm命令查看用户命令历史.doc

使用lastcomm命令查看用户命令历史使用lastcomm需要启用记账(Accounting)功能。需要安装bos.acct文件集执行如下命令为文件和目录设置所需的权限：cd /var/adm/usr/sbin/acct/nulladm wtmp pacct启停记账功能：启动记账功能：执行/usr/bin/su - adm -c /usr/sbin/acct/startup停止记账功能：执行/usr/bin/su - adm -c /usr/sbin/acct/shutacct如果要在系统启动时自动启动记账功能：修改/etc/rc文件，加入：/usr/bin/su - adm -c /usr/sbin/acct/startup使用lastcomm命令，其用法为：lastcomm Command Name Terminal ，Command为要过滤出来的执行命令，Name为发起命令的用户名，Terminal为用户执行命令时使用的终端设备名执行样例：CODEH50:root:/var/adm lastcomm pts/2sh S nobody pts/2 0.20 secs Wed Mar 10 11:50lastcomm nobody pts/2 0.05 secs Wed Mar 10 12:00who nobody pts/2 0.01 secs Wed Mar 10 12:00lastcomm nobody pts/2 0.11 secs Wed Mar 10 12:00netstat nobody pts/2 0.02 secs Wed Mar 10 12:00clear nobody pts/2 0.01 secs Wed Mar 10 11:59more nobody pts/2 0.02 secs Wed Mar 10 11:59vi nobody pts/2 0.02 secs Wed Mar 10 11:59sh F nobody pts/2 0.02 secs Wed Mar 10 11:59more nobody pts/2 0.01 secs Wed Mar 10 11:59ls nobody pts/2 0.01 secs Wed Mar 10 11:59vi nobody pts/2 0.02 secs Wed Mar 10 11:59sh F nobody pts/2 0.01 secs Wed Mar 10 11:59more nobody pts/2 0.01 secs Wed Mar 10 11:59ls nobody pts/2 0.02 secs Wed Mar 10 11:59sh F nobody pts/2 0.02 secs Wed Mar 10 11:59more nobody pts/2 0.01 secs Wed Mar 10 11:59ls nobody pts/2 0.01 secs Wed Mar 10 11:59man nobody pts/2 0.02 secs Wed Mar 10 11:58sh nobody pts/2 0.01 secs Wed Mar 10 11:58more nobody pts/2 0.02 secs Wed Mar 10 11:58sh F nobody pts/2 0.02 secs Wed Mar 10 11:57more nobody pts/2 0.01 secs Wed Mar 1