ACCTCOM(ADM)                       UNIX System V



     Name
          acctcom - search and print process accounting file(s)


     Syntax
          acctcom [[options][file]] . . .


     Description
          acctcom reads file, the standard input,  or  /usr/adm/pacct,
          in the form described by acct(F) and writes selected records
          to  the  standard  output.   Each  record   represents   the
          execution  of  one  process.   The  output shows the COMMAND
          Name, USER, TTYNamSTART TIME, END TIME,
          REAL  (SEC),  CPU (SEC),
          MEAN SIZE(K), and optionally, F (the fork/exec flag:
          1 for fork without exec), STAT (the system exit status), HOG
          FACTOR, KCORE MIN, CPU FACTOR,
          CHARS TRNSFD, and BLOCKS READ
          (total blocks read and written).

          The command name is prepended with a # if  it  was  executed
          with  super-user privileges.  If a process is not associated
          with a known terminal, a ? is printed in the TTYName field.

          If no files are specified, and  if  the  standard  input  is
          associated with a terminal or /dev/null (as is the case when
          using & in the shell), /usr/adm/pacct  is  read;  otherwise,
          the standard input is read.

          If any file arguments are given,  they  are  read  in  their
          respective order.  Each file is normally read forward, i.e.,
          in chronological order by process completion time.  The file
          /usr/adm/pacct is usually the current file to be examined; a
          busy system may need several such files of which all but the
          current file are found in /usr/adm/pacct?.  The options are:

          -a          Show some average statistics about the processes
                      selected.   The statistics will be printed after
                      the output records.
          -b          Read backwards, showing latest  commands  first.
                      This  option  has  no  effect  when the standard
                      input is read.
          -f          Print the fork/exec flag and system exit  status
                      columns in the output.
          -h          Instead of mean memory size, show  the  fraction
                      of  total  available  CPU  time  consumed by the
                      process  during  its  execution.    This   ``hog
                      factor'' is computed as:
                    (total CPU time)/(elapsed time).
          -i
          Print columns containing the I/O counts in the output.
          -k
          Instead of memory size, show total kcore-minutes.
          -m
          Show mean core size (the default).
          -r
          Show CPU factor (user time/(system-time + user-time).
          -t
          Show separate system and user CPU times.
          -v
          Exclude column headings from the output.
          -l line
          Show only processes belonging to terminal /dev/line.
          -u user
          Show only processes belonging to user that may be  specified
          by: a user ID, a login name that is then converted to a user
          ID, a # which designates only those processes executed  with
          super-user  privileges,  or  ?  which  designates only those
          processes associated with unknown user IDs.
          -g group
          Show only processes belonging to group.  The  group  may  be
          designated by either the group ID or group name.
          -s time
          Select processes existing at or after  time,  given  in  the
          format hr[:min[:sec]].
          -e time
          Select processes existing at or before time.
          -S time
          Select processes starting at or after time.
          -E time
          Select processes ending at or before time.  Using  the  same
          time  for both -S and -E shows the processes that existed at
          time.
          -n pattern
          Show only commands matching pattern that may  be  a  regular
          expression  as  in  ed(C)  except  that  + means one or more
          occurrences.
          -q
          Do not print any output  records;  just  print  the  average
          statistics as with the -a option.
          -o ofile
          Copy selected process records in the input  data  format  to
          ofile; suppress standard output printing.
          -H factor
          Show only processes that exceed factor, where factor is  the
          ``hog factor'' as explained in option -h above.
          -O sec
          Show only processes  with  CPU  system  time  exceeding  sec
          seconds.
          -C sec
          Show only processes with total CPU time, system  plus  user,
          exceeding sec seconds.
          -I chars
          Show only processes transferring more  characters  than  the
          cut-off number given by chars.


     Files
          /etc/passwd
          /usr/adm/pacct
          /etc/group


     See Also
          acct(ADM),   acctcms(ADM),   acctcon(ADM),    acctmerg(ADM),
          acctprc(ADM),  acctsh(ADM), fwtmp(ADM), ps(C), runacct(ADM),
          su(C), acct(S), acct(F), utmp(F)


     Notes
          acctcom reports only on processes that have terminated;  use
          ps(C)  for  active  processes.   If time exceeds the present
          time, then time is interpreted as occurring on the  previous
          day.


     (printed 8/23/89)                                  ACCTCOM(ADM)