acctcom(1)               USER COMMANDS                 acctcom(1)



NAME
     acctcom - search and print process accounting file(s)

SYNOPSIS
     acctcom [ options ] [ file . . . ]

DESCRIPTION
     acctcom reads file, the standard input,  or  /var/adm/pacct,
     in the form described by acct(4) and writes selected records
     to the standard output.  Each record represents  the  execu-
     tion  of  one  process.   The output shows the COMMAND NAME,
     USER, TTYNAME, START TIME, END TIME, REAL (SEC), CPU  (SEC),
     MEAN SIZE (K), and optionally, F (the fork/exec flag:  1 for
     fork without exec), STAT (the system exit status), HOG  FAC-
     TOR,  KCORE  MIN,  CPU FACTOR, CHARS TRNSFD, and BLOCKS READ
     (total blocks read and written).

     A # is prepended to the command name if the command was exe-
     cuted  with superuser privileges.  If a process is not asso-
     ciated with a known terminal, a ? is printed in the  TTYNAME
     field.

     If no files are specified, and  if  the  standard  input  is
     associated with a terminal or /dev/null (as is the case when
     using & in the shell), /var/adm/pacct  is  read;  otherwise,
     the standard input is read.

     If any file arguments are given,  they  are  read  in  their
     respective order.  Each file is normally read forward, i.e.,
     in chronological order by process completion time.  The file
     /var/adm/pacct is usually the current file to be examined; a
     busy system may need several such files of which all but the
     current file are found in /var/adm/pacctincr.

     The options are:

     -a          Show some average statistics about the processes
                 selected.   The statistics will be printed after
                 the output records.
     -b          Read backwards, showing latest  commands  first.
                 This  option  has  no  effect  when the standard
                 input is read.
     -f          Print the fork/exec flag and system exit  status
                 columns  in  the output.  The numeric output for
                 this option will be in octal.
     -h          Instead of mean memory size, show  the  fraction
                 of total available CPU time consumed by the pro-
                 cess during its execution.  This ``hog  factor''
                 is computed as (total CPU time)/(elapsed time).
     -i          Print columns containing the I/O counts  in  the
                 output.
     -k          Instead  of  memory  size,  show  total   kcore-



                                                                1

acctcom(1)               USER COMMANDS                 acctcom(1)



                 minutes.
     -m          Show mean core size (the default).
     -r          Show CPU factor (user-time/(system-time +  user-
                 time)).
     -t          Show separate system and user CPU times.
     -v          Exclude column headings from the output.
     -l line     Show  only  processes  belonging   to   terminal
                 /dev/term/line.
     -u user     Show only processes belonging to user  that  may
                 be specified by: a user ID, a login name that is
                 then converted to a user ID, a #,  which  desig-
                 nates   only   those   processes  executed  with
                 superuser privileges,  or  ?,  which  designates
                 only  those  processes  associated  with unknown
                 user IDs.
     -g group    Show only processes  belonging  to  group.   The
                 group  may  be designated by either the group ID
                 or group name.
     -s time     Select processes  existing  at  or  after  time,
                 given in the format hr[:min[:sec]].
     -e time     Select processes existing at or before time.
     -S time     Select processes starting at or after time.
     -E time     Select  processes  ending  at  or  before  time.
                 Using the same time for both -S and -E shows the
                 processes that existed at time.
     -n pattern  Show only commands matching pattern that may  be
                 a  regular expression as in regcmp(3G), except +
                 means one or more occurrences.
     -q          Do not print any output records, just print  the
                 average statistics as with the -a option.
     -o ofile    Copy selected process records in the input  data
                 format  to  ofile; suppress printing to standard
                 output.
     -H factor   Show only processes that  exceed  factor,  where
                 factor  is  the  ``hog  factor'' as explained in
                 option -h above.
     -O sec      Show only processes with CPU system time exceed-
                 ing sec seconds.
     -C sec      Show  only  processes  with   total   CPU   time
                 (system-time + user-time) exceeding sec seconds.
     -I chars    Show only processes transferring more characters
                 than the cutoff number given by chars.

FILES
     /etc/passwd
     /var/adm/pacctincr
     /etc/group

SEE ALSO
     ps(1), su(1).
     acct(2), regcmp(3G) in the Programmer's Reference Manual.
     acct(1M),    acctcms(1M),     acctcon(1M),     acctmerg(1M),



                                                                2

acctcom(1)               USER COMMANDS                 acctcom(1)



     acctprc(1M),  acctsh(1M),  fwtmp(1M),  runacct(1M), acct(4),
     utmp(4) in the System Administrator's Reference Manual.

NOTES
     acctcom reports only on processes that have terminated;  use
     ps(1) for active processes.

     If time exceeds the present time, then time  is  interpreted
     as occurring on the previous day.














































                                                                3