acctcom - search and print process accounting files
acctcom [-abfhikmqrtv] [-C sec] [-e time] [-E time] [-g group] [-H factor] [-I chars] [-l line] [-n pattern] [-o output-file] [-O sec] [-s time] [-S time] [-u user] [filename]...
The acctcom utility reads filenames, the standard input, or /var/adm/pacct, in the form described by acct.h(3HEAD) and writes selected records to standard output. Each record represents the execution of one process. The output shows the COMMAND NAME, USER, TTYNAME, START TIME, END TIME, REAL (SEC), CPU (SEC), MEAN SIZE (K), and optionally, F (the fork()/exec() flag: 1 for fork() without exec()), STAT (the system exit status), HOG FACTOR, KCORE MIN, CPU FACTOR, CHARS TRNSFD, and BLOCKS READ (total blocks read and written).
A # is prepended to the command name if the command was executed with super-user privileges. If a process is not associated with a known terminal, a ? is printed in the TTYNAME field.
If no filename is specified, and if the standard input is associated with a terminal or /dev/null (as is the case when using & in the shell), /var/adm/pacct is read; otherwise, the standard input is read.
If any filename arguments are given, they are read in their respective order. Each file is normally read forward, that is, in chronological order by process completion time. The file /var/adm/pacct is usually the current file to be examined; a busy system may need several such files of which all but the current file are found in /var/adm/pacctincr.
The following options are supported:
-aShow some average statistics about the processes selected. The statistics will be printed after the output records.
-bRead backwards, showing latest commands first. This option has no effect when standard input is read.
-fPrint the fork()/exec() flag and system exit status columns in the output. The numeric output for this option will be in octal.
-hInstead of mean memory size, show the fraction of total available CPU time consumed by the process during its execution. This "hog factor" is computed as (total CPU time)/(elapsed time).
-iPrint columns containing the I/O counts in the output.
-kInstead of memory size, show total kcore-minutes.
-mShow mean core size (the default).
-qDo not print any output records, just print the average statistics as with the -a option.
-rShow CPU factor (user-time/(system-time + user-time)).
-tShow separate system and user CPU times.
-vExclude column headings from the output.
-C secShow only processes with total CPU time (system-time + user-time) exceeding sec seconds.
-e timeSelect processes existing at or before time.
-E timeSelect processes ending at or before time. Using the same time for both -S and -E shows the processes that existed at time.
-g groupShow only processes belonging to group. The group may be designated by either the group ID or group name.
-H factorShow only processes that exceed factor, where factor is the "hog factor" as explained in option -h above.
-I charsShow only processes transferring more characters than the cutoff number given by chars.
-l lineShow only processes belonging to terminal /dev/term/line.
-n patternShow only commands matching pattern that may be a regular expression as in regcmp(3C), except + means one or more occurrences.
-o output-fileCopy selected process records in the input data format to output-file; suppress printing to standard output.
-O secShow only processes with CPU system time exceeding sec seconds.
-s timeSelect processes existing at or after time, given in the format hr[:min[:sec]].
-S timeSelect processes starting at or after time.
-u userShow only processes belonging to user. The user may be specified by a user ID, a login name that is then converted to a user ID, # (which designates only those processes executed with superuser privileges), or ? (which designates only those processes associated with unknown user IDs).
/etc/groupsystem group file
/etc/passwdsystem password file
/var/adm/pacctincractive processes accounting file
See attributes(5) for descriptions of the following attributes:
ATTRIBUTE TYPE ATTRIBUTE VALUE Availability SUNWaccu
ps(1), acct(1M), acctcms(1M), acctcon(1M), acctmerg(1M), acctprc(1M), acctsh(1M), fwtmp(1M), runacct(1M), su(1M), acct(2), regcmp(3C), acct.h(3HEAD), utmp(4), attributes(5)
acctcom reports only on processes that have terminated; use ps(1) for active processes.
|SunOS 5.11||acctcom (1)||11 Jan 1996|