NAME

acctcom - search and print process accounting file(s)

SYNOPSIS

acctcom [ options ] [ file . . . ]

DESCRIPTION

acctcom reads file, the standard input, or /var/adm/pacct, in the form described by acct(4) and writes selected records to the standard output. Each record represents the execution of one process. The output shows the COMMAND NAME, USER, TTYNAME, START TIME, END TIME, REAL (SEC), CPU (SEC), MEAN SIZE (K), and optionally, F (the fork/exec flag: 1 for fork without exec), STAT (the system exit status), HOG FACTOR, KCORE MIN, CPU FACTOR, CHARS TRNSFD, and BLOCKS READ (total blocks read and written).

A # is prepended to the command name if the command was executed with superuser privileges. If a process is not associated with a known terminal, a ? is printed in the TTYNAME field.

If no files are specified, and if the standard input is associated with a terminal or /dev/null (as is the case when using & in the shell), /var/adm/pacct is read; otherwise, the standard input is read.

If any file arguments are given, they are read in their respective order. Each file is normally read forward, i.e., in chronological order by process completion time. The file /var/adm/pacct is usually the current file to be examined; a busy system may need several such files of which all but the current file are found in /var/adm/pacctincr.

The options are:

-a          Show some average statistics about the processes
            selected.   The statistics will be printed after
            the output records.
-b          Read backwards, showing latest  commands  first.
            This  option  has  no  effect  when the standard
            input is read.
-f          Print the fork/exec flag and system exit  status
            columns  in  the output.  The numeric output for
            this option will be in octal.
-h          Instead of mean memory size, show  the  fraction
            of total available CPU time consumed by the pro-
            cess during its execution.  This ``hog  factor''
            is computed as (total CPU time)/(elapsed time).
-i          Print columns containing the I/O counts  in  the
            output.
-k          Instead  of  memory  size,  show  total   kcore-

            minutes.
-m          Show mean core size (the default).
-r          Show CPU factor (user-time/(system-time +  user-
            time)).
-t          Show separate system and user CPU times.
-v          Exclude column headings from the output.
-l line     Show  only  processes  belonging   to   terminal
            /dev/term/line.
-u user     Show only processes belonging to user  that  may
            be specified by: a user ID, a login name that is
            then converted to a user ID, a #,  which  desig-
            nates   only   those   processes  executed  with
            superuser privileges.  or  ?,  which  designates
            only  those  processes  associated  with unknown
            user IDs.
-g group    Show only processes  belonging  to  group.   The
            group  may  be designated by either the group ID
            or group name.
-s time     Select processes  existing  at  or  after  time,
            given in the format hr[:min[:sec]].
-e time     Select processes existing at or before time.
-S time     Select processes starting at or after time.
-E time     Select  processes  ending  at  or  before  time.
            Using the same time for both -S and -E shows the
            processes that existed at time.
-n pattern  Show only commands matching pattern that may  be
            a  regular expression as in regcmp(3G), except +
            means one or more occurrences.
-q          Do not print any output records, just print  the
            average statistics as with the -a option.
-o ofile    Copy selected process records in the input  data
            format  to  ofile; suppress printing to standard
            output.
-H factor   Show only processes that  exceed  factor,  where
            factor  is  the  ``hog  factor'' as explained in
            option -h above.
-O sec      Show only processes with CPU system time exceed-
            ing sec seconds.
-C sec      Show  only  processes  with   total   CPU   time
            (system-time + user-time) exceeding sec seconds.
-I chars    Show only processes transferring more characters
            than the cutoff number given by chars.

FILES

/etc/passwd
/var/adm/pacctincr
/etc/group

SEE ALSO

ps(1), su(1).
acct(2), regcmp(3G) in the Programmer's Reference Manual.
acct(1M),    acctcms(1M),     acctcon(1M),     acctmerg(1M),
acctprc(1M),  acctsh(1M),  fwtmp(1M),  runacct(1M), acct(4),
utmp(4) in the System Administrator's Reference Manual.

NOTES

acctcom reports only on processes that have terminated; use ps(1) for active processes.

If time exceeds the present time, then time is interpreted as occurring on the previous day.