acctcom(1) DG/UX R4.11MU05 acctcom(1)
NAME
acctcom - search and print process accounting file(s)
SYNOPSIS
acctcom [ [options] [file] ] ...
where:
options One or more of the options listed below under Options
file The name of an input file
DESCRIPTION
Acctcom reads file, the standard input, or /var/adm/pacct, in the
form described by acct(4) and writes selected records to the standard
output. Each record represents the execution of one process. The
output shows:
command name
user
ttyname
start time
end time
real (sec)
cpu (sec)
mean size(K)
It can optionally show:
f (the fork/exec flag: 1 for fork without exec; 2 if the
process was executed by a user with the appropriate privilege;
3 for fork without exec and the process was executed by a user
with the appropriate privilege.)
stat (the system wait status)
hog factor
Kcore min
CPU factor
characters transferred
blocks read (total blocks read and written)
The command name is prepended with a # if it was executed by a user
with the appropriate privilege. If a process is not associated with
a known terminal, a ? is printed in the TTYNAME field.
If no files are specified, and if the standard input is associated
with a terminal or /dev/null (as is the case when using & in the
shell), /var/adm/pacct is read; otherwise, the standard input is
read.
If any file arguments are given, they are read left to right. Each
file is normally read in chronological order by process completion
time. The file /var/adm/pacct is usually the current file to be
examined; a busy system may need several such files of which all but
the current file are found in /var/adm/pacct?.
Options
-a Show some average statistics about the processes
selected. The statistics will be printed after the
output records.
-b Read backwards, showing latest commands first. This
option has no effect when the standard input is read.
-f Print a column for the fork/exec flag and a stat column
representing all fields of the wait status except
WEXITSTATUS [see wait(2)]. The numeric output for this
option will be in octal.
-h Instead of mean memory size, show the fraction of total
available CPU time consumed by the process during its
execution. This "hog factor" is computed as total CPU
time divided by elapsed time.
-i Print columns containing the I/O counts in the output.
-k Instead of memory size, show total kcore-minutes.
-m Show mean core size (the default).
-r Show CPU factor (user time/(system-time + user-time).
-t Show separate system and user CPU times.
-v Exclude column headings from the output.
-l line Show only processes belonging to terminal /dev/line.
-u user Show only processes belonging to user, specified by: a
user ID, a login name that is then converted to a user
ID, a #, which designates only those processes executed
by a user with the appropriate privilege, or ?, which
designates only those processes associated with unknown
user IDs.
-g group Show only processes belonging to group, which can be
either the group ID or group name.
-s time Select processes existing at or after time, given in the
format hr[:min[:sec]].
-e time Select processes existing at or before time.
-S time Select processes starting at or after time.
-E time Select processes ending at or before time. Using the
same time for both -S and -E shows the processes that
existed at time.
-n pattern Show only commands matching pattern that may be a regular
expression as in ed(1) except that + means one or more
occurrences.
-o ofile Copy selected process records in the input data format to
ofile; suppress standard output printing.
-H factor Show only processes that exceed factor, where factor is
the "hog factor" as explained in option -h above.
-O sec Show only processes with CPU system time exceeding sec
seconds.
-C sec Show only processes with total CPU time, system plus
user, exceeding sec seconds.
-q Do not print any output records, just print the average
statistics as with the -a option.
-I chars Show only processes transferring more characters than the
cut-off number given by chars.
EXAMPLES
$ acctcom
This example will process and display the process accounting file.
The output shows the following information for all processes executed
since clearing the accounting log file:
command name
user
ttyname
start time
end time
real (sec)
cpu (sec)
mean size(K)
$ acctcom -q
cmds=2590 Real=147.66 CPU=1.30 USER=0.88 SYS=0.42 CHAR=54262.10
BLK=536.25 USR/TOT=0.68 HOG=0.01
$
This example will process and display the process accounting file in
summary form.
$ acctcom -u intern -b
COMMAND START END REAL CPU MEAN
NAME USER TTYNAME TIME TIME (SECS) (SECS) SIZE(K)
sh intern tty12 15:22:09 15:22:09 0.09 0.04 38.50
mail intern tty12 15:19:16 15:19:25 9.75 0.37 76.00
who intern tty12 15:19:09 15:19:10 1.13 0.30 52.40
ps intern tty12 15:19:03 15:19:05 2.32 0.52 137.46
mail intern tty12 15:18:28 15:18:59 31.92 0.28 79.64
vi intern tty12 15:13:05 15:17:58 293.84 35.89 157.32
acctcom intern tty12 15:12:51 15:13:01 10.67 7.04 129.75
cp intern tty12 15:06:16 15:06:16 0.59 0.08 42.50
more intern tty12 15:01:29 15:04:07 158.00 5.11 79.84
acctcom intern tty12 15:01:30 15:03:57 147.60 15.31 88.12
vi intern tty12 14:53:35 14:53:46 11.32 0.88 269.64
$
This example will process and display the process accounting file for
user "intern" and display them in reverse order.
$ acctcom -n vi
COMMAND START END REAL CPU MEAN
NAME USER TTYNAME TIME TIME (SECS) (SECS) SIZE(K)
vi intern tty12 15:39:48 15:41:57 129.44 3.13 263.67
vi clark ttyq0 15:44:38 15:46:15 97.28 3.85 253.67
vi intern tty12 16:04:27 16:04:55 28.04 1.33 157.83
vi haal tty21 16:31:40 16:32:35 55.62 1.52 272.32
vi harrise tty07 09:01:37 09:01:55 18.69 0.87 241.84
vi root tty07 09:02:10 09:02:22 12.34 0.59 330.31
vi haal tty21 13:20:38 13:21:50 72.52 1.73 262.47
vi mcadams tty00 13:45:37 13:45:44 7.80 0.88 174.05
vi clark ttyq1 14:08:27 14:09:10 43.46 4.73 147.92
$
This example will process and display the process accounting file
displaying all occurrences of the pattern "vi". This will report on
all users that have executed vi.
FILES
/etc/passwd
/var/adm/pacct
/var/adm/pacct?
/etc/group
DIAGNOSTICS
Exit code is 0 on successful completion, and >0 if an error occurs.
SEE ALSO
ps(1), su(1), acct(2), acct(4), utmp(4), acct(1M), acctcms(1M),
acctcon(1M), acctmerg(1M), acctprc(1M), acctsh(1M), fwtmp(1M),
runacct(1M).
BUGS
Acctcom reports only on processes that have terminated; use ps(1) for
active processes.
Licensed material--property of copyright holder(s)