Typical output from lastcomm:
10.64.37.10-man F root __ 0.00 secs Mon Jul 27 19:03 10.64.37.10-man F root __ 0.00 secs Mon Jul 27 19:03 10.64.37.10-man F root __ 0.00 secs Mon Jul 27 19:03 10.64.37.10-man F root __ 0.00 secs Mon Jul 27 19:03 10.64.37.10-man F root __ 0.00 secs Mon Jul 27 19:03 10.64.37.10-man F root __ 0.00 secs Mon Jul 27 19:03 10.64.37.10-man F root __ 0.00 secs Mon Jul 27 19:03 10.64.37.10-man F root __ 0.00 secs Mon Jul 27 19:03 10.64.37.10-man F root __ 0.00 secs Mon Jul 27 19:03 10.64.37.10-man F root __ 0.00 secs Mon Jul 27 19:03 10.64.37.10-man F root __ 0.00 secs Mon Jul 27 19:03 10.64.37.10-man F root __ 0.00 secs Mon Jul 27 19:03 10.64.37.10-man F root __ 0.00 secs Mon Jul 27 19:03 10.64.37.10-man F root __ 0.00 secs Mon Jul 27 19:03 10.64.37.10-man F root __ 0.00 secs Mon Jul 27 19:03
ad infinitum. There's more than 100000 entries per minute (!) which explains why /var/log/accounts/pacct fills up so quickly. There are some more sensible entries such as
sshd S root __ 0.01 secs Mon Jul 27 19:06
The format is supposed to be:
+ command name of the process + flags, as recorded by the system accounting routines: S -- command executed by super-user F -- command executed after a fork but without a following exec C -- command run in PDP-11 compatibility mode (VAX only) D -- command terminated with the generation of a core file X -- command was terminated with the signal SIGTERM + the name of the user who ran the process + time the process exited
Other possibly related tasks: