acctcom(1) acctcom(1)
NAME
acctcom - search and print process accounting file(s)
SYNOPSIS
acctcom [options] [file . . . ]
DESCRIPTION
acctcom reads file, the standard input, or /var/adm/pacct, in
the form described by acct(4) and writes selected records to
the standard output. Each record represents the execution of
one process. The output shows the COMMAND NAME, USER,
TTYNAME, START TIME, END TIME, REAL (SEC), CPU (SEC), MEAN
SIZE (K), and optionally, F (the fork/exec flag: 1 for fork
without exec), STAT (the system exit status), HOG FACTOR,
KCORE MIN, CPU FACTOR, CHARS TRNSFD, and BLOCKS READ (total
blocks read and written).
A # is prefixed to the command name if the command was
executed by a privileged user. If a process is not associated
with a known terminal, a ? is printed in the TTYNAME field.
If no files are specified, and if the standard input is
associated with a terminal or /dev/null (as is the case when
using & in the shell), /var/adm/pacct is read; otherwise, the
standard input is read.
If any file arguments are given, they are read in their
respective order. Each file is normally read forward, that
is, in chronological order by process completion time. The
file /var/adm/pacct is usually the current file to be
examined; a busy system may need several such files of which
all but the current file are found in /var/adm/pacct incr.
The options are:
-a Show some average statistics about the processes
selected. The statistics will be printed after
the output records.
-b Read backwards, showing latest commands first.
This option has no effect when the standard input
is read.
-f Print the fork/exec flag and system exit status
columns in the output. The numeric output for
this option will be in octal.
Copyright 1994 Novell, Inc. Page 1
acctcom(1) acctcom(1)
-h Instead of mean memory size, show the fraction of
total available CPU time consumed by the process
during its execution. This ``hog factor'' is
computed as (total CPU time)/(elapsed time).
-i Print columns containing the I/O counts in the
output.
-k Instead of memory size, show total kcore-minutes.
-m Show mean core size (the default).
-r Show CPU factor [user-time/(system-time + user-
time)].
-t Show separate system and user CPU times.
-v Exclude column headings from the output.
-l line Show only processes belonging to terminal
/dev/line.
-u user Show only processes belonging to user that may be
specified by: a user ID, a login name that is then
converted to a user ID, a # that designates only
those processes executed by a privileged user, or
? that designates only those processes associated
with unknown user IDs. The # and the ? should be
typed as \# and \?, respectively, to prevent the
shell from interpreting the # as the start of a
comment, or the ? as a pattern.
-g group Show only processes belonging to group. The group
may be designated by either the group ID or group
name.
-s time Select processes existing at or after time, given
in the format hr[:min[:sec]].
-e time Select processes existing at or before time.
-S time Select processes starting at or after time.
-E time Select processes ending at or before time. Using
the same time for both -S and -E shows the
processes that existed at time.
Copyright 1994 Novell, Inc. Page 2
acctcom(1) acctcom(1)
-n pattern Show only commands matching pattern that may be a
regular expression as in regcmp(3G), except +
means one or more occurrences.
-q Do not print any output records, just print the
average statistics as with the -a option.
-o ofile Copy selected process records in the input data
format to ofile; suppress printing to standard
output.
-H factor Show only processes that exceed factor, where
factor is the ``hog factor'' as explained in
option -h above.
-O sec Show only processes with CPU system time exceeding
sec seconds.
-C sec Show only processes with total CPU time (system-
time + user-time) exceeding sec seconds.
-I chars Show only processes transferring more characters
than the cutoff number given by chars.
FILES
/etc/passwd
/var/adm/pacctincr
/etc/group
REFERENCES
acct(1M), acct(2), acct(4), acctcms(1M), acctcon(1M),
acctmerg(1M), acctprc(1M), acctsh(1M), fwtmp(1M), ps(1),
regcmp(3G), runacct(1M), su(1M), utmp(4)
NOTICES
acctcom reports only on processes that have terminated; use
ps(1) for active processes.
If time exceeds the present time, then time is interpreted as
occurring on the previous day.
Copyright 1994 Novell, Inc. Page 3