Table of Contents
In this article, we will go through the steps to install lastcomm command on Linux Using 6 Easy Steps. lastcomm is a free and open source linux or unix based command line tool to display information about the previously executed commands recorded in acct or pacct file depending on the linux or unix distribution you are using. This GNU utility can be used to track the list of commands executed by a specific user so that the information can be later be used for security and other useful purposes.
lastcomm command is packaged with acct package on Ubuntu/Debian based systems and with psacct package on RHEL/CentOS based systems. Here we will see the steps to install lastcomm command in detail in below section.
How to Install lastcomm command on Linux Using 6 Easy Steps
Also Read: Solved "sh: 1: xdg-open: not found" error on Linux
Step 1: Prerequisites
a) You should have a running Linux Server.
b) You should have sudo or root access to run privileged commands.
c) You should have default package manager available in your System.
Step 2: Update Your Server
Before installing any new packages into the system, it is highly recommended to first update and then upgrade your system packages to the latest version using any of the below methods.
a) On Ubuntu/Debian System
On a Ubuntu/Debian based systems, you need to use sudo apt update to download and install all the latest updates to the system and then upgrade packages to the latest version using sudo apt upgrade command as shown below.
cyberithub@ubuntu:~$ sudo apt update && sudo apt upgrade
Get:1 http://security.ubuntu.com/ubuntu focal-security InRelease [114 kB]
Hit:2 https://dl.winehq.org/wine-builds/ubuntu focal InRelease
Hit:3 http://ppa.launchpad.net/flatpak/stable/ubuntu focal InRelease
Hit:4 http://in.archive.ubuntu.com/ubuntu focal InRelease
Hit:5 https://dl.google.com/linux/chrome/deb stable InRelease
Get:6 http://in.archive.ubuntu.com/ubuntu focal-updates InRelease [114 kB]
Hit:7 https://download.sublimetext.com apt/stable/ InRelease
Get:8 http://in.archive.ubuntu.com/ubuntu focal-backports InRelease [108 kB]
Get:9 http://security.ubuntu.com/ubuntu focal-security/main amd64 DEP-11 Metadata [59.8 kB]
Get:10 http://in.archive.ubuntu.com/ubuntu focal-updates/main amd64 DEP-11 Metadata [275 kB]
Get:11 http://security.ubuntu.com/ubuntu focal-security/universe amd64 DEP-11 Metadata [95.7 kB]
Get:12 http://security.ubuntu.com/ubuntu focal-security/multiverse amd64 DEP-11 Metadata [940 B]
Get:13 http://in.archive.ubuntu.com/ubuntu focal-updates/universe amd64 DEP-11 Metadata [410 kB]
Get:14 http://in.archive.ubuntu.com/ubuntu focal-updates/multiverse amd64 DEP-11 Metadata [944 B]
Get:15 http://in.archive.ubuntu.com/ubuntu focal-backports/main amd64 DEP-11 Metadata [7,956 B]
Get:16 http://in.archive.ubuntu.com/ubuntu focal-backports/universe amd64 DEP-11 Metadata [30.5 kB]
Fetched 1,217 kB in 7s (165 kB/s)
Reading package lists... Done
..................................................................
b) On RHEL/CentOS System
On a RHEL/CentOS based systems, you need to use sudo yum update or sudo dnf update command to download and install all the available updates to the system and then upgrade packages to the latest version using sudo yum upgrade or sudo dnf upgrade command as shown below.
[cyberithub@localhost ~] sudo yum update && yum upgrade
Loaded plugins: fastestmirror, langpacks
Determining fastest mirrors
epel/x86_64/metalink | 6.0 kB 00:00:00
* base: repo.extreme-ix.org
* epel: repo.extreme-ix.org
* extras: repo.extreme-ix.org
* updates: repo.extreme-ix.org
base | 3.6 kB 00:00:00
epel | 4.7 kB 00:00:00
extras | 2.9 kB 00:00:00
updates | 2.9 kB 00:00:00
(1/4): epel/x86_64/group_gz | 99 kB 00:00:00
(2/4): epel/x86_64/updateinfo | 1.0 MB 00:00:00
(3/4): epel/x86_64/primary_db | 7.0 MB 00:00:01
(4/4): updates/7/x86_64/primary_db | 20 MB 00:00:04
Resolving Dependencies
--> Running transaction check
---> Package autofs.x86_64 1:5.0.7-116.el7_9 will be updated
---> Package autofs.x86_64 1:5.0.7-116.el7_9.1 will be an update
---> Package bpftool.x86_64 0:3.10.0-1160.83.1.el7 will be updated
---> Package bpftool.x86_64 0:3.10.0-1160.88.1.el7 will be an update
---> Package daxctl-libs.x86_64 0:65-5.el7 will be updated
---> Package daxctl-libs.x86_64 0:65-6.el7_9 will be an update
..............................................
Step 3: Install lastcomm
In the next step, you need to install lastcomm command by using any of the below given methods depending on the linux distribution you are currently using.
a) On Ubuntu/Debian System
If you are using Ubuntu/Debian based system, then you need to use sudo apt install acct command as shown below. This will download and install the package along with all its dependencies from default ubuntu repo.
cyberithub@ubuntu:~$ sudo apt install acct Reading package lists... Done Building dependency tree Reading state information... Done The following package was automatically installed and is no longer required: libappstream-glib8 Use 'sudo apt autoremove' to remove it. The following NEW packages will be installed: acct 0 upgraded, 1 newly installed, 0 to remove and 20 not upgraded. Need to get 87.0 kB of archives. After this operation, 337 kB of additional disk space will be used. Get:1 http://in.archive.ubuntu.com/ubuntu focal/main amd64 acct amd64 6.6.4-2 [87.0 kB] Fetched 87.0 kB in 1s (84.8 kB/s) Selecting previously unselected package acct. (Reading database ... 199874 files and directories currently installed.) Preparing to unpack .../acct_6.6.4-2_amd64.deb ... Unpacking acct (6.6.4-2) ... Setting up acct (6.6.4-2) ... update-rc.d: warning: start and stop actions are no longer supported; falling back to defaults update-rc.d: warning: stop runlevel arguments (1) do not match acct Default-Stop values (0 1 6) Processing triggers for man-db (2.9.1-1) ... Processing triggers for install-info (6.7.0.dfsg.2-5) ... Processing triggers for systemd (245.4-4ubuntu3.20) ...
b) On RHEL/CentOS System
If you are using RHEL/CentOS based systems, then you need to use sudo yum install psacct or sudo dnf install psacct command as shown below. This will download and install the package from the default repo along with all its required dependencies.
[cyberithub@localhost ~] sudo yum install psacct Loaded plugins: fastestmirror, langpacks Loading mirror speeds from cached hostfile * base: repo.extreme-ix.org * epel: repo.extreme-ix.org * extras: repo.extreme-ix.org * updates: repo.extreme-ix.org Resolving Dependencies --> Running transaction check ---> Package psacct.x86_64 0:6.6.1-13.el7 will be installed --> Finished Dependency Resolution Dependencies Resolved ============================================================================================================================================================= Package Arch Version Repository Size ============================================================================================================================================================= Installing: psacct x86_64 6.6.1-13.el7 base 93 k Transaction Summary ============================================================================================================================================================= Install 1 Package Total download size: 93 k Installed size: 199 k Is this ok [y/d/N]: Y Downloading packages: psacct-6.6.1-13.el7.x86_64.rpm | 93 kB 00:00:00 Running transaction check Running transaction test Transaction test succeeded Running transaction Installing : psacct-6.6.1-13.el7.x86_64 1/1 Verifying : psacct-6.6.1-13.el7.x86_64 1/1 Installed: psacct.x86_64 0:6.6.1-13.el7 Complete!
Step 4: Verify Installation
After successful installation, you can verify the installed files by using any of the below methods depending on the distribution you are currently using.
a) On Ubuntu/Debian System
If you are using Ubuntu/Debian based system, then you need to use dpkg -L acct command verify the installed files path.
cyberithub@ubuntu:~$ dpkg -L acct
/.
/etc
/etc/cron.daily
/etc/cron.daily/acct
/etc/cron.monthly
/etc/cron.monthly/acct
/etc/default
/etc/default/acct
/etc/init.d
/etc/init.d/acct
/usr
/usr/bin
/usr/bin/ac
/usr/bin/lastcomm
/usr/sbin
/usr/sbin/accton
/usr/sbin/dump-acct
/usr/sbin/dump-utmp
/usr/sbin/sa
/usr/share
/usr/share/doc
/usr/share/doc/acct
........................................
b) On RHEL/CentOS System
If you are using RHEL/CentOS based systems, then you need to use sudo rpm -ql psacct command as shown below.
[cyberithub@localhost ~] sudo rpm -ql psacct
/etc/logrotate.d/psacct
/usr/bin/ac
/usr/bin/lastcomm
/usr/lib/systemd/system/psacct.service
/usr/libexec/psacct/accton-create
/usr/sbin/accton
/usr/sbin/dump-acct
/usr/sbin/dump-utmp
/usr/sbin/sa
/usr/share/doc/psacct-6.6.1
/usr/share/doc/psacct-6.6.1/COPYING
/usr/share/doc/psacct-6.6.1/README
/usr/share/info/accounting.info.gz
/usr/share/man/man1/ac.1.gz
/usr/share/man/man1/lastcomm.1.gz
/usr/share/man/man8/accton.8.gz
/usr/share/man/man8/dump-acct.8.gz
/usr/share/man/man8/dump-utmp.8.gz
/usr/share/man/man8/sa.8.gz
/var/account
/var/account/pacct
Step 5: Using lastcomm
Once lastcomm command is available in the system, you can use it to serve your purpose. For example, here we are checking all the activities of user cyberithub by using lastcomm --user cyberithub command as shown below.
[cyberithub@localhost ~] lastcomm --user cyberithub
Step 6: Uninstall lastcomm
Once you are done with lastcomm command, you can choose to uninstall it from your system by using any of the below methods depending on the linux distribution you are currently using.
a) On Ubuntu/Debian System
If you are using Ubuntu/Debian based system then you can use sudo apt remove acct command to remove the package as shown below.
cyberithub@ubuntu:~$ sudo apt remove acct Reading package lists... Done Building dependency tree Reading state information... Done The following package was automatically installed and is no longer required: libappstream-glib8 Use 'sudo apt autoremove' to remove it. The following packages will be REMOVED: acct 0 upgraded, 0 newly installed, 1 to remove and 20 not upgraded. After this operation, 337 kB disk space will be freed. Do you want to continue? [Y/n] Y (Reading database ... 199902 files and directories currently installed.) Removing acct (6.6.4-2) ... Processing triggers for install-info (6.7.0.dfsg.2-5) ... Processing triggers for man-db (2.9.1-1) ...
b) On RHEL/CentOS System
If you are looking to uninstall lastcomm command from RHEL/CentOS based system then you need to use sudo yum remove psacct command as shown below.
[cyberithub@localhost ~] sudo yum remove psacct Loaded plugins: fastestmirror, langpacks Resolving Dependencies --> Running transaction check ---> Package psacct.x86_64 0:6.6.1-13.el7 will be erased --> Finished Dependency Resolution Dependencies Resolved ============================================================================================================================================================= Package Arch Version Repository Size ============================================================================================================================================================= Removing: psacct x86_64 6.6.1-13.el7 @base 199 k Transaction Summary ============================================================================================================================================================= Remove 1 Package Installed size: 199 k Is this ok [y/N]: y Downloading packages: Running transaction check Running transaction test Transaction test succeeded Running transaction Erasing : psacct-6.6.1-13.el7.x86_64 1/1 Verifying : psacct-6.6.1-13.el7.x86_64 1/1 Removed: psacct.x86_64 0:6.6.1-13.el7 Complete!