acctcom(1)                (Accounting Utilities)                 acctcom(1)


   NAME
         acctcom - search and print process accounting file(s)

   SYNOPSIS
         acctcom [ options ] [ file . . . ]

   DESCRIPTION
         acctcom reads file, the standard input, or /var/adm/pacct, in the
         form described by acct(4) and writes selected records to the standard
         output.  Each record represents the execution of one process.  The
         output shows the COMMAND NAME, USER, TTYNAME, START TIME, END TIME,
         REAL (SEC), CPU (SEC), MEAN SIZE (K), and optionally, F (the
         fork/exec flag:  1 for fork without exec), STAT (the system exit
         status), HOG FACTOR, KCORE MIN, CPU FACTOR, CHARS TRNSFD, and BLOCKS
         READ (total blocks read and written).

         A # is prepended to the command name if the command was executed with
         superuser privileges.  If a process is not associated with a known
         terminal, a ? is printed in the TTYNAME field.

         If no files are specified, and if the standard input is associated
         with a terminal or /dev/null (as is the case when using & in the
         shell), /var/adm/pacct is read; otherwise, the standard input is
         read.

         If any file arguments are given, they are read in their respective
         order.  Each file is normally read forward, i.e., in chronological
         order by process completion time.  The file /var/adm/pacct is usually
         the current file to be examined; a busy system may need several such
         files of which all but the current file are found in
         /var/adm/pacctincr.

         The options are:

         -a          Show some average statistics about the processes
                     selected.  The statistics will be printed after the
                     output records.
         -b          Read backwards, showing latest commands first.  This
                     option has no effect when the standard input is read.
         -f          Print the fork/exec flag and system exit status columns
                     in the output.  The numeric output for this option will
                     be in octal.
         -h          Instead of mean memory size, show the fraction of total
                     available CPU time consumed by the process during its
                     execution.  This ``hog factor'' is computed as (total
                     CPU time)/(elapsed time).
         -i          Print columns containing the I/O counts in the output.
         -k          Instead of memory size, show total kcore-minutes.
         -m          Show mean core size (the default).




   7/91                                                                 Page 1

   acctcom(1)                (Accounting Utilities)                 acctcom(1)


         -r          Show CPU factor (user-time/(system-time + user-time)).
         -t          Show separate system and user CPU times.
         -v          Exclude column headings from the output.
         -l line     Show only processes belonging to terminal /dev/term/line.
         -u user     Show only processes belonging to user that may be
                     specified by: a user ID, a login name that is then
                     converted to a user ID, a #, which designates only those
                     processes executed with superuser privileges, or ?, which
                     designates only those processes associated with unknown
                     user IDs.
         -g group    Show only processes belonging to group.  The group may be
                     designated by either the group ID or group name.
         -s time     Select processes existing at or after time, given in the
                     format hr[:min[:sec]].
         -e time     Select processes existing at or before time.
         -S time     Select processes starting at or after time.
         -E time     Select processes ending at or before time.  Using the
                     same time for both -S and -E shows the processes that
                     existed at time.
         -n pattern  Show only commands matching pattern that may be a regular
                     expression as in regcmp(3G), except + means one or more
                     occurrences.
         -q          Do not print any output records, just print the average
                     statistics as with the -a option.
         -o ofile    Copy selected process records in the input data format to
                     ofile; suppress printing to standard output.
         -H factor   Show only processes that exceed factor, where factor is
                     the ``hog factor'' as explained in option -h above.
         -O sec      Show only processes with CPU system time exceeding sec
                     seconds.
         -C sec      Show only processes with total CPU time (system-time +
                     user-time) exceeding sec seconds.
         -I chars    Show only processes transferring more characters than the
                     cutoff number given by chars.

   FILES
         /etc/passwd
         /var/adm/pacctincr
         /etc/group

   SEE ALSO
         ps(1), su(1).
         acct(2), regcmp(3G), acct(4), utmp(4) in the Programmer's Reference
         Manual.
         acct(1M), acctcms(1M), acctcon(1M), acctmerg(1M), acctprc(1M),
         acctsh(1M), fwtmp(1M), runacct(1M), in the System Administrator's
         Reference Manual.

   NOTES
         acctcom reports only on processes that have terminated; use ps(1) for
         active processes.


   Page 2                                                                 7/91

   acctcom(1)                (Accounting Utilities)                 acctcom(1)


         If time exceeds the present time, then time is interpreted as
         occurring on the previous day.



















































   7/91                                                                 Page 3