acctcom(1) acctcom(1)
NAME
acctcom - search and print process accounting files
SYNOPSIS
acctcom [option]... [file]...
DESCRIPTION
acctcom reads data in a defined format [see acct(4)] from the files
specified as command-line arguments, from standard input, or from a
system file, and extracts the required process information. The
selected information is written to standard output.
acctcom reports only on processes that have terminated. Information on
active processes can be obtained with the ps command.
OPTIONS
No option specified
acctcom displays a list giving standard information on the indi-
vidual processes. Each process record includes entries for the
following fields:
COMMAND START END REAL CPU MEAN
NAME USER TTYNAME TIME TIME (SECS) (SECS) SIZE(K)
The output is based on the first in, first out principle, which
means that information on older processes is displayed first.
-a Show some average statistics about the processes selected. The
statistics will be printed after the process records.
-b Read backwards, showing latest commands first. This option has no
effect if the information is being read from standard input.
-f Print additional columns for the fork/exec flag and the system
exit status. The numeric output for this option will be in octal.
-h (hog factor) Instead of mean memory size, show the fraction of
total available CPU time consumed by the process during its exe-
cution. This value is known as the "hog factor" and is computed
as:
(total CPU time)/(elapsed time).
-i Print additional columns containing the I/O counts in the output.
-k Show total kcore-minutes, i.e. the cumulative memory usage of the
process in kilobyte segments during each minute of its execution.
-m Show the mean core size, i.e. the mean value of the main memory
requirement for each process. This option is set by default.
-r Show CPU factor [user-time/(system-time + user-time)].
Page 1 Reliant UNIX 5.44 Printed 11/98
acctcom(1) acctcom(1)
-t Show separate system and user times.
-v Exclude column headings from the output.
-l line
Show only those processes which are associated with the terminal
with the device entry /dev/term/line.
-u user
(user) Show only processes belonging to user. user may be speci-
fied as:
- a user ID,
- a login name (which is converted to a user ID by the command
itself),
- # (for processes executed with system administrator privi-
leges), or
- ? (for processes associated with unknown user IDs).
-g group
(group) Show only processes belonging to group. The group may be
specified in the form of a group ID or a group name.
The time specifications in the following options must be given in the
format hour[:minute[:second]].
If the specified time is later than the present time, time is taken to
refer to the previous day.
-s time
Select processes existing at or after time.
-e time
Select processes existing at or before time.
-S time
Select processes starting at or after time.
-E time
Select processes ending at or before time.
Using the same time for both -S and -E shows the processes that
existed at time.
-n pattern
Show only commands with names matching the specified pattern.
pattern may be in standard regular expression form [see
regcmp(3G)], except that the plus sign (+) stands for one or more
occurrences of the pattern.
Page 2 Reliant UNIX 5.44 Printed 11/98
acctcom(1) acctcom(1)
-q Do not print any process records, just print the average statis-
tics as with the -a option.
-o file
Copy selected process records in the input data format to file
without writing the information to standard output.
-H hogfactor
Show only those processes with a hog factor exceeding the value
specified for hogfactor. The method used to compute the hog fac-
tor is explained in option -h above.
-O sec
Show only processes with CPU system time exceeding sec seconds.
-C sec
Show only processes with total CPU time (system-time + user-time)
exceeding sec seconds.
-I chars
Show only processes transferring more characters than the cutoff
number given by chars.
file Name of the file containing the process information to be
analyzed by acctcom. This information must be in the format
described under acct(4).
If you name more than one file, the files will be read in the
order in which you name them.
file not specified:
If the standard input is associated with the controlling terminal
but does not contain any process information, or if the standard
input is connected with /dev/null as is the case with background
processes of the shell, the file /var/adm/pacct is read. This
file usually contains the latest process information. A busy sys-
tem may need several such files, in which case they are stored
under the name /var/adm/pacctincr, where incr is a sequential
increment.
Otherwise, standard input is read.
The system will not generate its /var/adm/pacctincr files unless
accounting has been started up /usr/lib/acct/startup. See the
System Administrator's Guide.
Page 3 Reliant UNIX 5.44 Printed 11/98
acctcom(1) acctcom(1)
Output
The following section lists the column titles and explains the meaning
of each column in the output of acctcom. The letters following the
column titles indicate the option with which each column appears in
the output. "all" means that the column is displayed with all options.
Each output record represents the execution of one process.
COMMAND NAME (all)
Name of the executed command to which the subsequent process
information refers. A # is prepended to the command name if the
command was executed with system administrator privileges.
USER (all)
Login name under which the process was started.
TTYNAME (all)
The controlling terminal of the process. If the process is not
associated with a known terminal, a ? is printed in this field.
START TIME (all)
Time at which the process was started.
END TIME (all)
Time at which the process terminated.
REAL (SEC) (all)
Total runtime for the process, in seconds.
CPU (SEC) (all)
CPU system time consumed by the process, in seconds.
CPU SYS (-t)
CPU time consumed by the system.
(SECS) USER (-t)
CPU time consumed by the user.
MEAN SIZE(K) (all)
Mean memory size for the process.
F (-f)
The fork/exec flag: 1 for fork without exec.
STAT (-f)
System exit status.
HOG FACTOR (-h, -H)
Hog factor.
Page 4 Reliant UNIX 5.44 Printed 11/98
acctcom(1) acctcom(1)
KCORE MIN (-k)
Cumulative memory usage of the process in kilobyte segments dur-
ing each minute of its execution.
CPU FACTOR (-r)
CPU factor.
CHARS TRNSFD (-I)
Number of characters transferred.
BLOCKS READ
Total number of blocks read and written.
EXAMPLES
Example 1
You need to look at standard accounting information on all the latest
terminated processes:
$ acctcom
ACCOUNTING RECORDS FROM: Wed Feb 6 10:22:30 1991
COMMAND START END REAL CPU MEAN
NAME USER TTYNAME TIME TIME (SECS) (SECS) SIZE(K)
#accton root tty01 10:22:30 10:22:30 0.13 0.03 8.17
turnacct root tty01 10:22:29 10:22:30 1.27 0.12 0.92
rm root tty01 10:22:30 10:22:30 0.03 0.03 1.50
rm root tty01 10:22:31 10:22:31 0.02 0.02 2.25
startup root tty01 10:22:28 10:22:30 2.51 0.20 0.53
acctcom root tty01 10:23:21 10:23:21 0.39 0.20 1.43
getopt root tty01 10:24:09 10:24:09 0.05 0.03 8.00
expr root tty01 10:24:09 10:24:09 0.07 0.03 0.67
...
If the output needs to be paged, you can pipe the output of acctcom to
the pg command:
$ acctcom | pg
...
Page 5 Reliant UNIX 5.44 Printed 11/98
acctcom(1) acctcom(1)
Example 2
You now want to select the accounting information for all processes
with CPU system time exceeding one second, save this information in a
file named boredom, and then print the contents of that file.
$ acctcom -O 1 -o boredom
ACCOUNTING RECORDS FROM: Wed Feb 6 10:22:30 1991
$ acctcom boredom
ACCOUNTING RECORDS FROM: Wed Feb 6 10:24:10 1991
COMMAND START END REAL CPU MEAN
NAME USER TTYNAME TIME TIME (SECS) (SECS) SIZE(K)
find root pts/0 10:24:10 10:25:48 98.40 1.66 0.17
acctdusg root pts/0 10:24:10 10:26:21 131.20 1.36 0.24
FILES
/etc/passwd
File containing login names/user IDs.
/etc/group
File containing group names/IDs.
/var/adm/pacctincr
File containing the current process information. Busy systems may
need several such files, in which case they are numbered sequen-
tially and can be distinguished by the suffix incr.
SEE ALSO
ps(1), su(1), acct(1M), acctcms(1M), acctcon(1M), acctmerg(1M),
acctprc(1M), fwtmp(1M), runacct(1M), acct(2), regcmp(3G), acct(4),
utmp(4).
Page 6 Reliant UNIX 5.44 Printed 11/98