acctcom - search and print process accounting files
acctcom [-abfhikmqrtv] [-C sec] [-e time] [-E time]
[-g group] [-H factor] [-I chars] [-l line]
[-n pattern] [-o output-file] [-O sec] [-s time]
[-S time] [-u user] [filename]...
The acctcom utility reads filenames, the standard
input, or /var/adm/pacct, in the form described by
acct.h(3HEAD) and writes selected records to standard output. Each
record represents the execution of one process. The output shows the
COMMAND NAME, USER, TTYNAME, START TIME, END
TIME, REAL (SEC), CPU (SEC), MEAN SIZE (K),
and optionally, F (the fork()/exec() flag: 1 for
fork() without exec()), STAT (the system exit status),
HOG FACTOR, KCORE MIN, CPU FACTOR, CHARS
TRNSFD, and BLOCKS READ (total blocks read and
written).
A `#' is prepended to the command name if the command was
executed with super-user privileges. If a process is not associated with a
known terminal, a `?' is printed in the TTYNAME field.
If no filename is specified, and if the standard input is
associated with a terminal or /dev/null (as is the case when using
`&' in the shell), /var/adm/pacct is read; otherwise, the
standard input is read.
If any filename arguments are given, they are read in their
respective order. Each file is normally read forward, that is, in
chronological order by process completion time. The file
/var/adm/pacct is usually the current file to be examined; a busy
system may need several such files of which all but the current file are
found in /var/adm/pacctincr.
The following options are supported:
-a
Show some average statistics about the processes
selected. The statistics will be printed after the output records.
-b
Read backwards, showing latest commands first. This
option has no effect when standard input is read.
-f
Print the fork()/exec() flag and system
exit status columns in the output. The numeric output for this option will be
in octal.
-h
Instead of mean memory size, show the fraction of total
available CPU time consumed by the process during its execution. This
"hog factor" is computed as (total CPU time)/(elapsed
time).
-i
Print columns containing the I/O counts in the
output.
-k
Instead of memory size, show total kcore-minutes.
-m
Show mean core size (the default).
-q
Do not print any output records, just print the average
statistics as with the -a option.
-r
Show CPU factor (user-time/(system-time +
user-time)).
-t
Show separate system and user CPU times.
-v
Exclude column headings from the output.
-C sec
Show only processes with total CPU time
(system-time + user-time) exceeding sec seconds.
-e time
Select processes existing at or before time.
-E time
Select processes ending at or before time. Using
the same time for both -S and -E shows the processes that
existed at time.
-g group
Show only processes belonging to group. The
group may be designated by either the group ID or group
name.
-H factor
Show only processes that exceed factor, where
factor is the "hog factor" as explained in option -h
above.
-I chars
Show only processes transferring more characters than the
cutoff number given by chars.
-l line
Show only processes belonging to terminal
/dev/term/line.
-n pattern
Show only commands matching
pattern that may be a
regular expression as in
regcmp(3C), except
+ means one or more
occurrences.
-o output-file
Copy selected process records in the input data format to
output-file; suppress printing to standard output.
-O sec
Show only processes with CPU system time exceeding
sec seconds.
-s time
Select processes existing at or after time, given
in the format hr[:min[:sec]].
-S time
Select processes starting at or after time.
-u user
Show only processes belonging to user. The user
may be specified by a user ID, a login name that is then converted to a
user ID, `#' (which designates only those processes executed
with superuser privileges), or `?' (which designates only those
processes associated with unknown user IDs).
/etc/group
system group file
/etc/passwd
system password file
/var/adm/pacctincr
active processes accounting file
See attributes(7) for descriptions of the following
attributes:
| ATTRIBUTE
TYPE |
ATTRIBUTE VALUE |
| CSI |
Enabled |
ps(1), acct(2), regcmp(3C),
acct.h(3HEAD), utmp(5), attributes(7), acct(8),
acctcms(8), acctcon(8), acctmerg(8), acctprc(8),
acctsh(8), fwtmp(8), runacct(8), su(8)
System Administration Guide: Basic Administration
acctcom reports only on processes that have terminated; use
ps(1) for active processes.