NAME
acctcom - Outputs selected process accounting record sum-
maries
SYNOPSIS
/usr/sbin/acct/acctcom -[q or o] -[abhikmrtv] -[C seconds g
group H factor I number l line
n pattern O seconds u user e time E time s time S time]
[file(s)]
The acctcom command reads process accounting records from
files specified by the file(s) parameter from standard input
or from the /var/adm/pacct file. Records from the specified
input source are written to the default output device.
FLAGS
-a Lists average statistics about the processes selected.
Statistics are displayed at the end of the output
records in the format var=val (where var is the listed
variable and val is a numerical value to the nearest
hundreth) and in the listed order.
Variable Value
CMDS The total number of commands listed in the named file(s).
REAL Average real time per process.
CPU Average CPU time per process.
USER Average user CPU time per process.
SYS Average system CPU time per process.
CHAR Average number of characters transferred.
BLK Average number of blocks transferred.
USR/TOT Average CPU factor (average user time divided by total
CPU time).
HOG Average hog factor (average CPU time divided by average
elasped time).
-b Lists backward in time-ascending order, showing the
most recent commands first. This flag has no effect
when the acctcom command reads from the default input
device. The column heading format is the same as the
default column heading format.
-C seconds
Lists processes whose total CPU time (system time +
user time) exceeds seconds. The column heading format
is the same as the default column heading format.
-e time
Lists processes starting at or before the specified
START BEFORE time. You may use the NLTIME environment
variable to specify the order of hours, minutes, and
seconds. The default order is hh:mm:ss. The column
heading format is as follows:
ACCOUNTING RECORDS FROM: day mon date hh:mm:ss yy
START BEFORE: day mon date hh:mm:ss yy
COMMAND START END REAL CPU MEAN
NAME USER TTYNAME TIME TIME (SECS) (SECS) SIZE(K)
-E time
Lists processes ending at or before the specified END
BEFORE time. You may use the NLTIME environment vari-
able to specify the order of hours, minutes, and
seconds. The default order is hh:mm:ss. When you
specify the same time for both the -E and -S flags, the
acctcom command displays processes that existed at the
specified time. The column heading format is as fol-
lows:
ACCOUNTING RECORDS FROM: day mon date hh:mm:ss yy
END BEFORE : day mon date hh:mm:ss yy
COMMAND START END REAL CPU MEAN
NAME USER TTYNAME TIME TIME (SECS) (SECS) SIZE(K)
-f Adds columns to list the state of the fork/exec flag F
(means of executing another process) and the system
exit value STAT (0 or an error code) in the output by
adding F and STAT columns, respectively, to the output
column headings. The column heading format is as fol-
lows:
ACCOUNTING RECORDS FROM: day mon date hh:mm:ss yy
COMMAND START END REAL CPU MEAN
NAME USER TTYNAME TIME TIME (SECS) (SECS) SIZE(K) F STAT
-g group
Lists processes belonging to group. You may specify
either the group ID or the group name. The column head-
ing format is the same as the default column heading
format.
-h The MEAN SIZE(K) column heading is replaced with the
HOG FACTOR heading to list the fraction of total avail-
able CPU time consumed by the process (see HOG below).
The column heading format is as follows:
ACCOUNTING RECORDS FROM: day mon date hh:mm:ss yy
COMMAND START END REAL CPU HOG
NAME USER TTYNAME TIME (SECS) (SECS) FACTOR
-H hogfactor
Lists processes that exceed hogfactor. The column head-
ing format is the same as the default column heading
format.
-i The MEAN SIZE(K) column heading is replaced with the
CHARS TRANSFD heading to list the number of characters
transferred during read or write I/O operations. The
BLOCKS READ column is added to list the number of
blocks transferred. The column heading format is as
follows:
ACCOUNTING RECORDS FROM: day mon date hh:mm:ss yy
COMMAND START END REAL CPU CHARS BLOCKS
NAME USER TTYNAME TIME TIME (SECS) (SECS) TRANSFD READ
-I number
Lists processes transferring more than number charac-
ters. The column heading format is the same as the
default column heading format.
-k The MEAN SIZE(K) column heading is replaced with the
KCORE MIN heading to list the total K-core minutes. The
column heading format is as follows:
ACCOUNTING RECORDS FROM: day mon date hh:mm:ss yy
COMMAND START END REAL CPU KCORE
NAME USER TTYNAME TIME TIME (SECS) (SECS) MIN
-l line
Lists only processes belonging to workstation
/dev/line. The column heading format is the same as the
default column heading format.
-m Lists mean process memory used. The -h flag or -k flag
turns off the -m flag. The column heading format is the
same as the default column heading format.
-n pattern
Lists all commands matching pattern, where pattern is a
regular expression, similar to those use with the ed
command. The column heading format is the same as the
default column heading format.
selflag -o file
Copies all selflag process records to file in the acct
binary format. The selflag process records are those
that can be selected using the -C, -e, -E, -g, -H, -I,
-l, -n, -O, -s, -S, and -u flags. If no selflag is
specified, all process records are copied. No column
heading format is printed except the date and time the
accounting records are taken from.
ACCOUNTING RECORDS FROM: day mon date hh:mm:ss yy
-O seconds
Lists processes with CPU system time exceeding seconds.
The column heading format is the same as the default
column heading format.
-q Does not produce a listing. Only outputs the average
statistics that are produced at the end of a listing
when the -a flag is used.
-r Lists CPU factor. The default heading MEAN SIZE(K)
column is changed to CPU FACTOR (see USR/TOT). The
column heading format is as follows:
ACCOUNTING RECORDS FROM: day mon date hh:mm:ss yy
COMMAND START END REAL CPU CPU
NAME USER TTYNAME TIME TIME (SECS) (SECS) FACTOR
-s time
Lists only those processes that existed on or after the
specified END AFTER time. You can use the NLTIME
environment variable to specify the order of hours,
minutes, and seconds. The default order is hh:mm:ss.
The column heading format is as follows:
ACCOUNTING RECORDS FROM: day mon date hh:mm:ss yy
END AFTER : day mon date hh:mm:ss yy
COMMAND START END REAL CPU MEAN
NAME USER TTYNAME TIME TIME (SECS) (SECS) SIZE(K)
-S time
List only those processes starting at or after the
specified START AFTER time. You can use the NLTIME
environment variable to specify the order of hours,
minutes, and seconds. The default timestamp order is
hh:mm:ss. The column heading format is as follows:
ACCOUNTING RECORDS FROM: day mon date hh:mm:ss yy
START AFTER : day mon date hh:mm:ss yy
COMMAND START END REAL CPU MEAN
NAME USER TTYNAME TIME TIME (SECS) (SECS) SIZE(K)
-t Lists system and user CPU times under separate head-
ings. The default column CPU (SECS) is changed to CPU
SYS and lists the system CPU time. The default column
MEAN SIZE(K) is changed to (SECS) USER and lists user
CPU time. The column heading format is as follows:
ACCOUNTING RECORDS FROM: day mon date hh:mm:ss yy
COMMAND START END REAL CPU (SECS)
NAME USER TTYNAME TIME TIME (SECS) SYS USER
-u user
Lists processes belonging to user; a user ID, a login
name that is converted to a user ID, a # (number sign)
to select processes run by the root user, or a ? (ques-
tion mark) to select processes associated with unknown
user IDs. The column heading format is the same as the
default column heading format.
-v Eliminates column headings from the output. The column
format is the same as the default column format.
DESCRIPTION
The acctcom command reads process accounting records from
files specified by the file(s) parameter from standard input
or from the /var/adm/pacct file. Records from the specified
input source are written to the default output device.
The use of this command is not restricted to individuals
with administrative authority. The acctcom command is stored
in the /usr/bin directory for accessiblity to most users.
When you do not specify a file(s) parameter and standard
input is assigned to a workstation or to /dev/null (when a
process runs in the background, for example), the acctcom
command reads the /var/adm/pacct file.
When you specify file(s), the acctcom process reads each
file chronologically in time-descending order according to
process completion time. Usually /var/adm/pacct is the
current file that acctcom writes to the default output dev-
ice. Because the ckpacct procedure keeps this file from
growing too large, a busy system may have several pacct
files. All but the current file has the following pathname:
/var/adm/pacctn, where n is a unique integer whose value is
assigned to any additional /var/adm/pacctn files in the
order they are created.
Each record represents execution times for one completed
process. The default output format includes the command
name, username, tty name, process start time, process end
time, real seconds, CPU seconds, and mean memory size (in
kilobytes). The process summary output has the following
default column heading format.
ACCOUNTING RECORDS FROM: day mon date hh:mm:ss yy
COMMAND START END REAL CPU MEAN
NAME USER TTYNAME TIME TIME (SECS) (SECS) SIZE(K)
The date and timestamp format is day mon date hh:mm:ss yy
where day is the day of the week, mon is the month, hh:mm:ss
is the time expressed in hours (in 24-hour clock notation),
minutes, and seconds, and yy is the year expressed as four
digits.
By using appropriate flags, you may also output the state of
the fork/exec flag, F; the system exit value, STAT; the
ratio of total CPU time to elapsed time, HOG FACTOR; the
product of memory used and elapsed time, KCORE MIN; the
ratio of user time to total (system plus user) time, CPU
FACTOR; the number of characters transferred during I/O
operations, CHARS TRNSFD; and the total number of blocks
read or written, BLOCKS READ.
Whenever a process is run under root or su authority, the
command name is prefixed with a # (number sign). When a pro-
cess is not assigned to a known tty; for example, when the
cron daemon runs the process, a ? (question mark) is written
in the TTYNAME column.
The acctcom command only reports on processes that have com-
pleted. Use the ps command to examine the status of active
processes. When a specified time is later than the current
time, it is interpreted as occurring on the previous day.
For any flag value that produces a date and timestamp in an
output heading, the order of date and time information is
locale dependent. The date and timestamps shown in the
examples are for the default headings, but their order may
be changed using the NLTIME environment variable to change
the timestamp format.
EXAMPLES
1. To display information about processes that exceed 2.0
seconds of CPU time, enter:
/usr/sbin/acct/acctcom -O 2 < /var/adm/pacct
The process information is read from the /var/adm/pacct
file.
2. To display information about processes belonging to the
Finance group, enter:
/usr/sbin/acct/acctcom -g Finance < /var/adm/pacct
The process information is read from the /var/adm/pacct
file.
3. To display information about processes belonging to tty
/dev/console that run after 5:00 p.m., enter:
/usr/sbin/acct/acctcom -l /dev/console -s 17:00
The process information is read from the /var/adm/pacct
file by default.
FILES
/usr/sbin/acct/acctcom
Specifies the command path
/var/adm/pacct
The active process accounting database file.
/etc/passwd, /etc/group
User and group database files.
/usr/include/sys/acct.h, /usr/include/utmp.h
Accounting header files that define formats for writing
accounting files.
RELATED INFORMATION
Commands: acct(8), ed(8), ps(8), runacct(8), su(1)
Calls: acct(2)
Daemons: cron(8)
Acknowledgement and Disclaimer