acctcom(1M) acctcom(1M)
NAME
acctcom - search and format process accounting files
SYNOPSIS
acctcom [-a] [-b] [-C sec] [-e time] [-E time] [-f]
[-g group] [-h] [-H factor] [-i] [-I chars] [-k] [-l line]
[-m] [-n pattern] [-o ofile] [-O sec] [-q] [-r] [-s time]
[-S time] [-t] [-u user] [-v] [file] ...
DESCRIPTION
acctcom reads file, the standard input, or /usr/adm/pacct,
in the form described by acct(4) and writes selected records
to the standard output. Each record represents the execu-
tion of one process. The output shows:
COMMAND NAME
USER
TTYNAME
START TIME
END TIME
REAL (SEC)
CPU (SEC)
MEAN SIZE (K)
and optionally,
F STAT
HOG FACTOR
KCORE MIN
CPU FACTOR
CHARS TRNSFD
BLOCKS READ
where
F is the fork/exec flag: 1 for fork without exec, STAT is
the system exit status, and BLOCKS READ is the total blocks
read and written.
The command name has a # inserted in front of it if it was
executed with superuser privileges. If a process is not as-
sociated with a known terminal, a ? is placed in the TTYNAME
field.
If no files are specified, and if the standard input is as-
sociated with a terminal or /dev/null (as is the case when
using & in the shell), /usr/adm/pacct is read; otherwise,
the standard input is read.
If any file arguments are given, they are read in their
respective order. Each file is normally read forward, that
is, in chronological order by process completion time. The
April, 1990 1
acctcom(1M) acctcom(1M)
file /usr/adm/pacct is usually the current file to be exam-
ined; a busy system may need several such files, of which
all but the current file are found in /usr/adm/pacct?. The
flag options are:
-a Show some average statistics about the processes
selected. The statistics will be placed after
the output records.
-b Read backwards, showing latest commands first.
This option has no effect when the standard in-
put is read.
-C sec Show only processes with total CPU time, system
plus user, exceeding sec seconds.
-e time Select processes existing at or before time,
given in the format hr[:min[:sec]].
-E time Select processes ending at or before time. Us-
ing the same time for both -S and -E shows the
processes that existed at time.
-f Print the fork/exec flag and system exit status
columns in the output.
-g group Show only processes belonging to group. The
group may be designated by either the group ID
or group name.
-h Instead of mean memory size, show the fraction
of total available CPU time consumed by the pro-
cess during its execution. This hog factor is
computed as:
(total-CPU-time)/(elapsed-time).
-H factor Show only processes that exceed factor, where
factor is the hog factor, as explained in option
-h, above.
-i Print columns containing the I/O counts in the
output.
-I chars Show only processes transferring more characters
than the cut-off number given by chars.
-k Instead of memory size, show total kcore-
minutes.
-lline Show only processes belonging to terminal
2 April, 1990
acctcom(1M) acctcom(1M)
/dev/line.
-m Show mean core size (the default).
-n pattern Show only commands matching pattern. pattern
may be a regular expression as in ed(1), except
that + means one or more occurrences.
-o ofile Copy selected process records in the input data
format to ofile; suppress writing on standard
output.
-O sec Show only processes with CPU system time exceed-
ing sec seconds.
-q Do not produce any output records, just produce
the average statistics as with the -a option.
-r Show CPU factor (user-time)/(system-time +
user-time).
-s time Select processes existing at or after time,
given in the format hr[:min[:sec]].
-S time Select processes starting at or after time.
-t Show separate system and user CPU times.
-v Exclude column headings from the output.
-uuser Show only processes belonging to user that may
be specified by: a user ID, a login name that is
then converted to a user ID, a # which desig-
nates only those processes executed with su-
peruser privileges, or ? which designates only
those processes associated with unknown user
ID's.
acctcom reports only on processes that have terminated; use
ps(1) for active processes.
FILES
/bin/acctcom
/etc/passwd
/usr/adm/pacct?
/etc/group
SEE ALSO
ksh(1), ps(1), sh(1), su(1), acct(1M), acctcms(1M),
acctcon(1M), acctmerg(1M), acctprc(1M), acctsh(1M),
fwtmp(1M), runacct(1M), acct(2), acct(4), utmp(4).
April, 1990 3
BUGS
If time exceeds the present time, then time is interpreted
as occurring on the previous day.
4 April, 1990