csacom(1)csacom(1)NAMEcsacom - searches and prints the Comprehensive System Accounting (CSA)
process accounting files
SYNOPSIScsacom [-a] [-b] [-c] [-f] [-h] [-i] [-k] [-m] [-p] [-q] [-r] [-t] [-v]
[-w] [-A] [-G] [-L] [-J] [-M] [-N] [-P] [-T] [-U] [-V] [-W] [-X] [-Z] [-
e time] [-g group] [-j jid] [-l line] [-n pattern] [-o ofile] [-s time]
[-u user] [-C sec] [-E time] [-H factor] [-I chars] [-O sec] [-S time]
[files]
DESCRIPTION
The csacom utility reads data files, in the format defined in the acct.h
file and writes selected records to standard output. You can specify
files to be read; otherwise, the standard input, the file specified by
the PACCT_FILE parameter in the /etc/csa.conf file, or the
/var/adm/acct/day/pacct file is read. Each record represents the
execution of one process.
Memory and I/O fields are printed as zero if memory and I/O record
accounting are turned off.
The csacom utility accepts three types of options: output file options,
selection options, and printing options.
Output Options
-o ofile Copies selected process records in the input data format to
ofile, an output file you specify. Suppresses standard output
printing.
Selection Options
-e time Selects processes existing at or before time, given in the
format [Ddd:]hh[:mm[:ss]]. (See EXAMPLES.) The letter D
flags the presence of the relative day offset parameter, which
allows csacom to select records from a previous day. (To
determine the day offset, use the -W option.)
-g group Selects only processes belonging to group. You can designate
the group by either the group ID or group name.
-j jid Selects only processes that have a job ID that matches the jid
argument. The jid argument is expected in hexadecimal. The
"0x" prefix or the "0X" prefix are optional.
-l line Selects only processes that belong to terminal /dev/line.
-n pattern Selects only commands matching pattern that may be a regular
expression, as in regcmp(3G).
-s time Selects processes existing at or after time, given in the
format [Ddd:]hh[:mm[:ss]]. See the -e option and EXAMPLES for
more information on this format. Using the same time for both
Page 1
csacom(1)csacom(1)-s and -e shows the processes that existed at time.
-u user Selects only processes that belong to user. May be specified
by a user ID, a login name that is then converted to a user
ID, a # symbol designating only those processes executed with
superuser privileges, or a question mark (?) designating only
those processes associated with an unknown user ID. To avoid
interpretation by the shell, the question mark must be
escaped.
-C sec Selects only processes with total CPU time (system plus user
time) exceeding sec seconds.
-E time Selects processes ending at or before time, given in the
format [Ddd:]hh[:mm[:ss]]. See the -e option and EXAMPLES for
more information on this format.
-H factor Selects only processes that exceed factor. Factor is the "hog
factor" (as explained in the description of printing option
-h).
-I chars Selects only processes that transfer more characters than the
cutoff number given by chars. Processes that do not have I/O
information (I/O record accounting turned off) are not
selected.
-O sec Selects only processes with CPU system time exceeding sec
seconds.
-S time Selects processes that start at or after time, given in the
format [Ddd:]hh[:mm[:ss]]. See the -e option for more
information on this format.
Printing Options
-a Shows some average statistics about the processes selected. The
statistics are printed after the output records.
-b Reads backward, showing latest commands first. This option has no
effect when the standard input is read. The -b and -W options are
mutually exclusive.
-c Prints the number of read and write system calls, separately.
-f Prints the fork/exec flag followed by the exit status. Output is in
octal.
-h Prints the fraction of total available CPU time consumed by the
process during its execution. This is known as the "hog factor" and
is computed as follows:
Page 2
csacom(1)csacom(1)
(total CPU time)/(elapsed time)
-i Prints the number of characters read and written, and the number of
blocks read and written. The read and written values are printed
separately.
-k Prints total kcore-minutes and kvirtual-minutes. These are the
average memory sizes of the process if its execution time is
normalized to one minute.
-m Prints mean core size and mean virtual memory size. These are the
average memory sizes of the process while executing. This is the
default print option. If you do not specify any other print
options, -m is selected. If you do specify other print options and
you want mean memory sizes to print, you must specify -m.
-p Prints process ID and parent process ID.
-q Prints only the average statistics as with the -a option. Does not
print any output records.
-r Prints the CPU factor (user time/(system time + user time)).
-t Prints separate system and user CPU times.
-v Excludes column headings from the output.
-w Prints the run queue, block I/O, and raw I/O wait times.
-A Prints the array session handle.
-G Prints the numeric group ID.
-L Prints the accounting configuration records that report events, such
as when accounting was started and stopped, and when accounting
files were switched. If no other printing option is selected with
-L, -m is assumed.
-J Prints a column with job IDs.
-M Prints the high-water core memory and virtual memory usage values.
-N Prints the nice field value and scheduling discipline. The nice
value is the scheduling priority for use of CPU time. The range of
values typically is 0 through 39, with 0 being super user and higher
nice values being lower priorities. Scheduling discipline is the
scheduling mode of a shared group.
-P Prints the project ID.
Page 3
csacom(1)csacom(1)-T Prints the start-of-job and end-of-job data. Ignores all other
print options, except the -b, -v, and -L options.
-U Shows all user IDs in numeric format.
-V Combines the I/O and wait time values time. This option must be
specified with the -c, -i or -w option.
-W Prints the start and end dates and each date change found in the
file. Ignores all other print and selection options, except the -L
option. This option is useful if your data spans more than 1 day
(that is, not 00:00 to 00:00) and if more than 1 day of data is
present in the pacct file. The day number of the date change is
printed and can be used with the time selects. (See Example 2.)
Only timestamps of end-of-process records are used to determine if
there is a date change. The -b and -W options are mutually
exclusive.
-X Prints the process start date. The date follows the last data
printed on the line and will be in the format: day month date year
(for example, Sat Feb 12 2000).
-Y Prints the process end date. The date follows the last data printed
on the line and will be in the format: day month date year (for
example, Sat Feb 12 2000).
-Z Skips (does not print) first seven fields (must be specified with
one of the print options (-cfhikmprtwAGJMNPXY)).
files
Input file(s) you specify. These are one or more of the
/var/adm/acct/day/pacct* files. If you do not specify files, and if
the standard input is not associated with a terminal or /dev/null
(as is the case when using & in the shell), the standard input is
read. Otherwise, the file specified by the PACCT_FILE parameter in
the /etc/csa.conf file is read. If that parameter does not exist,
then /var/adm/acct/day/pacct is read. Therefore, when executing
csacom using the Network Queuing System (NQS), you must specify
files.
Any file arguments specified are read in their respective order. Each
file is usually read forward; that is, in chronological order by process
completion time. The /var/adm/acct/day/pacct file is the current file to
be examined.
The output fields are as follows:
--------------------------------------------------------------------
Field Name Option Definition
--------------------------------------------------------------------
COMMAND NAME ! Z ASCII command name OR #command name if
Page 4
csacom(1)csacom(1)
executed with super-user privileges
USER ! Z ASCII user name
! Z Numeric user ID
&& -U
TTYNAME ! Z ASCII tty name (? in this field
indicates that a process is not
associated with a known terminal)
START TIME ! Z Start time of process in clock format
(that is, 10:01:25)
END TIME ! Z End time of process in clock format (that
is, 10:10:15)
REAL (SECS) ! Z Elapsed time of process in seconds
CPU (SECS) ! Z && !-t CPU time used by the process in seconds
OR
SYSTEM (SECS) -t System time used by the process in
seconds
USER (SECS) -t User time used by the process in seconds
CHARS READ -i Number of characters read
CHARS WRITTEN -i Number of characters written
CPU FACTOR -r User time divided by the CPU time
HOG FACTOR -h CPU time divided by the elapsed time
BLOCKS READ -i Number of blocks read
BLOCKS WRITTEN -i Number of blocks written
CHARS TRNSFD -iV Number of characters transferred
BLOCKS TRNSFD -iV Number of blocks transferred
MEAN CORE SIZE (KB) -m Average amount of core memory used by the
process in kilobytes
MEAN VIRT SIZE (KB) -m Average amount of virtual memory used by the
process in kilobytes
KCORE MIN (KB) -k Amount of core memory used by the process
in kilobytes * minutes
KVIRTUAL MIN (KB) -k Amount of virtual memory used by the process
in kilobytes * minutes
F STAT -f F is the fork/exec flag in octal.
STAT is the exit condition in octal (value
from exit() system call). Signal number: 0
means manual exit; 0200 means core dump.
JOB ID -J Job identifier
ARRAY SESSION HANDLE -A Array session identifier
PROJECT ID -P Project identifier
GROUP ID -G Group identifier
LOGICAL READS -c Number of read system calls
LOGICAL WRITES -c Number of write system calls
LOGICAL REQS -cV Number of logical I/O requests
RUN QUEU WAIT (S) -w Run queue wait time in seconds
IOWAIT (SECS) BLOCK -w Block I/O wait time in seconds
IOWAIT (SECS) RAW -w Raw I/O wait time in seconds
IOWAIT (SECS) -wV I/O wait time in seconds
Page 5
csacom(1)csacom(1)
PID -p Process identifier
PPID -p Parent process identifier
HIMEM (KBYTES) CORE -M High-water core memory usage value in
kilobytes
HIMEM (KBYTES) VIRTUAL -M High-water virtual memory usage value in
kilobytes
NICE -N Nice value of the process
SCHED DISC -N Scheduling discipline of the share group
TIME -T Time of the event in clock format
(that is, 10:01:25)
EVENT -T Event that caused the accounting record
to be written
CORE_HIMEM -T Job high-water core memory usage value
in kilobytes
VIRT_HIMEM -T Job high-water virtual memory usage value
PROCESS START DATE -X Date that the process started in ctime
format
PROCESS END DATE -Y Date that the process ended in ctime
format
NOTES
The csacom command does not print the daemon accounting records in the
data files.
The csacom command reports only on processes that have terminated; use
the ps(1) command to view active processes.
If time exceeds the present time, time is interpreted as occurring on the
previous day.
EXAMPLES
Example 1: The following example generates a list of commands executed
by user samuel by examining all current process accounting files. The
output includes system and user CPU times. In this example, if the pacct
files are not specified in the order shown, the commands may not be
reported in ascending time order.
csacom-u samuel -t /var/adm/acct/day/pacct?* /var/adm/acct/day/pacct
Example 2: The following example shows how, using the printing option
-W, the day number of the date change is printed.
csacom-W
Day 0: Mon Apr 3 10:20:11 2000 - first record.
Day 1: Tue Apr 4 00:00:00 2000 - date change.
Day 4: Fri Apr 7 10:20:00 2000 - date change.
Day 4: Fri Apr 7 14:43:10 2000 - last record.
Page 6
csacom(1)csacom(1)
Example 3: The following example shows how you would select and print
data from day 4, 10:20 A.M. in Example 2; you would use the same format
to specify dates and times when using selection options -e, -E, -s, -S.
csacom-s D4:10:20
Example 4: The following example shows how you would select and print
data from the pacct file for an interval on day 4 between 8:00 A.M. and
4:00 P.M.
csacom-S D4:08:00:00 -E D4:16:00:00
FILES
/etc/csa.conf Accounting configuration file
/etc/passwd Password file that contains user names and
user IDs
/etc/group Group file that contains group names and
group IDs
/var/adm/acct/day/pacct Process accounting file that contains
resource usage information for processes
running on the system
SEE ALSOcsaaddc(1M), csacms(1M), csacon(1M), csarun(1M), csaswitch(1M), nice(1),
ps(1), su(1), schedctl(2), acctctl(3c), regcmp(3G).
Page 7
