acctcom(1) User Commands acctcom(1)NAMEacctcom - search and print process accounting files
SYNOPSISacctcom [-abfhikmqrtv] [-C sec] [-e time] [-E time]
[-g group] [-H factor] [-I chars] [-l line]
[-n pattern] [-o output-file] [-O sec] [-s time]
[-S time] [-u user] [filename]...
DESCRIPTION
The acctcom utility reads filenames, the standard input, or
/var/adm/pacct, in the form described by acct.h(3HEAD) and writes
selected records to standard output. Each record represents the execu‐
tion of one process. The output shows the COMMAND NAME, USER, TTYNAME,
START TIME, END TIME, REAL (SEC), CPU (SEC), MEAN SIZE (K), and option‐
ally, F (the fork()/exec() flag: 1 for fork() without exec()), STAT
(the system exit status), HOG FACTOR, KCORE MIN, CPU FACTOR, CHARS
TRNSFD, and BLOCKS READ (total blocks read and written).
A `#' is prepended to the command name if the command was executed
with super-user privileges. If a process is not associated with a known
terminal, a `?' is printed in the TTYNAME field.
If no filename is specified, and if the standard input is associated
with a terminal or /dev/null (as is the case when using `&' in the
shell), /var/adm/pacct is read; otherwise, the standard input is read.
If any filename arguments are given, they are read in their respective
order. Each file is normally read forward, that is, in chronological
order by process completion time. The file /var/adm/pacct is usually
the current file to be examined; a busy system may need several such
files of which all but the current file are found in /var/adm/pacct‐
incr.
OPTIONS
The following options are supported:
-a Show some average statistics about the processes
selected. The statistics will be printed after the
output records.
-b Read backwards, showing latest commands first. This
option has no effect when standard input is read.
-f Print the fork()/exec() flag and system exit status
columns in the output. The numeric output for this
option will be in octal.
-h Instead of mean memory size, show the fraction of
total available CPU time consumed by the process dur‐
ing its execution. This "hog factor" is computed as
(total CPU time)/(elapsed time).
-i Print columns containing the I/O counts in the out‐
put.
-k Instead of memory size, show total kcore-minutes.
-m Show mean core size (the default).
-q Do not print any output records, just print the aver‐
age statistics as with the -a option.
-r Show CPU factor (user-time/(system-time + user-
time)).
-t Show separate system and user CPU times.
-v Exclude column headings from the output.
-C sec Show only processes with total CPU time (system-time
+ user-time) exceeding sec seconds.
-e time Select processes existing at or before time.
-E time Select processes ending at or before time. Using the
same time for both -S and -E shows the processes that
existed at time.
-g group Show only processes belonging to group. The group may
be designated by either the group ID or group name.
-H factor Show only processes that exceed factor, where factor
is the "hog factor" as explained in option -h above.
-I chars Show only processes transferring more characters than
the cutoff number given by chars.
-l line Show only processes belonging to terminal
/dev/term/line.
-n pattern Show only commands matching pattern that may be a
regular expression as in regcmp(3C), except + means
one or more occurrences.
-o output-file Copy selected process records in the input data for‐
mat to output-file; suppress printing to standard
output.
-O sec Show only processes with CPU system time exceeding
sec seconds.
-s time Select processes existing at or after time, given in
the format hr[:min[:sec]].
-S time Select processes starting at or after time.
-u user Show only processes belonging to user. The user may
be specified by a user ID, a login name that is then
converted to a user ID, `#' (which designates only
those processes executed with superuser privileges),
or `?' (which designates only those processes associ‐
ated with unknown user IDs).
FILES
/etc/group system group file
/etc/passwd system password file
/var/adm/pacctincr active processes accounting file
ATTRIBUTES
See attributes(5) for descriptions of the following attributes:
┌─────────────────────────────┬─────────────────────────────┐
│ ATTRIBUTE TYPE │ ATTRIBUTE VALUE │
├─────────────────────────────┼─────────────────────────────┤
│Availability │system/accounting/legacy │
├─────────────────────────────┼─────────────────────────────┤
│CSI │Enabled │
└─────────────────────────────┴─────────────────────────────┘
SEE ALSOps(1), acct(1M), acctcms(1M), acctcon(1M), acctmerg(1M), acctprc(1M),
acctsh(1M), fwtmp(1M), runacct(1M), su(1M), acct(2), regcmp(3C),
acct.h(3HEAD), utmp(4), attributes(5)
System Administration Guide: Basic Administration
NOTESacctcom reports only on processes that have terminated; use ps(1) for
active processes.
SunOS 5.11 11 Jan 1996 acctcom(1)
