NAME

acctcom − search and print process accounting file(s)

SYNOPSIS

acctcom [[options][file]] . . .

DESCRIPTION

Acctcom reads file, the standard input, or /usr/adm/pacct, in the form described by acct(5) and writes selected records to the standard output. Each record represents the execution of one process. The output shows the COMMAND NAME, USER, TTYNAME, START TIME, END TIME, REAL (SEC), CPU (SEC), MEAN SIZE(K), and optionally, F (the fork/exec flag: 1 for fork without exec) and STAT (the system exit status). 

The command name is prepended with a # if it was executed with super-user privileges.  If a process is not associated with a known terminal, a ? is printed in the TTYNAME field. 

If no files are specified, and if the standard input is associated with a terminal or /dev/null (as is the case when using & in the shell), /usr/adm/pacct is read, otherwise the standard input is read. 

If any file arguments are given, they are read in their respective order.  Each file is normally read forward, i.e., in chronological order by process completion time.  The file /usr/adm/pacct is usually the current file to be examined; a busy system may need several files, in which case all but the current will be found in /usr/adm/pacct?.  The options are:

−b Read backwards, showing latest commands first. 

−f Print the fork/exec flag and system exit status columns in the output. 

−h Instead of mean memory size, show the fraction of total available CPU time consumed by the process during its execution.  This “hog factor” is computed as:

(total CPU time)/(elapsed time). 

−i Print columns containing the I/O counts in the output. 

−k Instead of memory size, show total kcore-minutes. 

−m Show mean core size (the default). 

−r Show CPU factor (user time/(system-time + user-time). 

−t Show separate system and user CPU times. 

−v Exclude column headings from the output. 

−l line Show only processes belonging to terminal /dev/line.

−u user Show only processes belonging to user that may be specified by: a user ID, a login name that is then converted to a user ID, a # which designates only those processes executed with super-user privileges, or ?  which designates only those processes associated with unknown user IDs. 

−g group Show only processes belonging to group. The group may be designated by either the group ID or group name. 

−d mm/dd Any time arguments following this flag are assumed to occur on the given month and day, rather than during the last 24 hours.  This is needed for looking at old files. 

−s time Show only those processes that existed on or after time, given in the form hr:min:sec. The :sec or :min:sec may be omitted. 

−e time Show only those processes that existed on or before time. Using the same time for both −s and −e shows the processes that existed at time.

−n pattern Show only commands matching pattern that may be a regular expression as in ed(1) except that + means one or more occurrences. 

−H factor Show only processes that exceed factor, where factor is the “hog factor” as explained in option −h above. 

−O time Show only those processes with operating system CPU time that exceeds time.

−C time Show only those processes that exceed time that indicates the total CPU time. 

Listing options together has the effect of a logical and. 

FILES

/etc/passwd
/usr/adm/pacct
/etc/group

SEE ALSO

acct(1M), acctcms(1M), acctcon(1M), acctmerg(1M), acctprc(1M), acctsh(1M), fwtmp(1M), ps(1), runacct(1M), su(1), acct(2), acct(5), utmp(5). 

BUGS

Acctcom only reports on processes that have terminated; use ps(1) for active processes.

May 16, 1980