NAME

acctcom − Displays selected process accounting record summaries

SYNOPSIS

/usr/bin/acctcom [−abfhikmqrtv] [−C seconds] [−e time] [−E time] [−g group] [−H factor] [−I number] [−l line] [select_flag −o file] [−n pattern] [−O seconds] [−s time] [−S time] [−u username] [file ...]

FLAGS

−aDisplays average statistics about the selected processes.  Statistics are displayed at the end of the output records in the format var=# (for example, CMDS=439), where the value (#) is given to the nearest hundredth.  The var specifies the following:

VariableValue

CMDSTotal number of commands listed in the specified file

REALAverage real time per process

CPUAverage CPU time per process

USERAverage user CPU time per process

SYSAverage system CPU time per process

CHARAverage number of characters transferred

BLKAverage number of blocks transferred

USR/TOTAverage CPU factor (average user time divided by total CPU time)

HOGAverage hog factor (average CPU time divided by average elapsed time)

-bDisplays information about the most recently executed commands first.  This flag has no effect when the acctcom command reads from the default input device or if more than one process accounting file is specified. The column heading format is the same as the default column heading format. 

-C seconds
Lists processes whose total CPU time (system time + user time) is greater than the value specified by seconds.  The column heading format is the same as the default column heading format. 

-e timeDisplays information only about processes that start at or before the specified time, which is specified as hh[:mm[:ss]].  The column heading format is as follows:

ACCOUNTING RECORDS FROM: day mon date hh:mm:ss yy
START BEFORE: day mon date hh:mm:ss yy
COMMAND         START  END   REAL    CPU     MEAN
NAME USER TTYNAME TIME TIME (SECS) (SECS) SIZE(K)

-E timeDisplays information only about processes that end at or before the specified time, which is specified as hh[:mm[:ss]].  If you specify the same time for both the -E and -S flags, the acctcom command displays processes that existed at the specified time. The column heading format is as follows:

ACCOUNTING RECORDS FROM: day mon date hh:mm:ss yy
END BEFORE  : day mon date hh:mm:ss yy
COMMAND         START  END   REAL    CPU     MEAN
NAME USER TTYNAME TIME TIME (SECS) (SECS) SIZE(K)

-fDisplays information about the fork/exec flag (used to execute another process) in the F column and the system exit value STAT, which can be zero (0) or an error code, in the STAT column in addition to the default column heading format.  The column heading format is as follows:

ACCOUNTING RECORDS FROM: day mon date hh:mm:ss yy
COMMAND                START  END   REAL    CPU     MEAN
NAME USER TTYNAME TIME TIME (SECS) (SECS) SIZE(K) F STAT

-g groupDisplays only the processes that belong to the specified group. You may specify either the group ID or the group name. The column heading format is the same as the default column heading format. 

-hDisplays the hog factor instead of the mean memory size.  The hog factor is the CPU time used by the process divided by the real time.  The output is the same as the default column format output except the MEAN SIZE(K) column heading is replaced by the .HOG FACTOR heading.  The column heading format is as follows:

ACCOUNTING RECORDS FROM: day mon date hh:mm:ss yy
COMMAND         START  END   REAL    CPU     HOG
NAME USER TTYNAME TIME TIME (SECS) (SECS) FACTOR

-H  hogfactor
Displays information about processes that exceed the value specified by the hogfactor variable.  The output format is the same as the default column heading format. 

-i Displays the number of characters and blocks transferred during read or write I/O operations.  The output is similar to the default column heading format, except the CHARS TRANSFD column replaces the MEAN SIZE(K) column, and the BLOCKS READ column is added to the output.  The column heading format is as follows:

ACCOUNTING RECORDS FROM: day mon date hh:mm:ss yy
COMMAND   START  END   REAL    CPU     CHARS    BLOCKS
NAME USER TTYNAME TIME TIME (SECS) (SECS) TRANSFD READ

-Inumber
Displays information about the processes that transfer more than the number of characters specified by the number variable.  The output format is the same as the default column heading format. 

-kDisplays the total number of K-core minutes, which is the number of kilobytes of memory used by the process multiplied by the buffer time used.  The output format is the same as the default column heading format, except the KCORE MIN column heading replaces the MEAN SIZE(K) column heading.  The column heading format is as follows:

ACCOUNTING RECORDS FROM: day mon date hh:mm:ss yy
COMMAND    START  END   REAL    CPU     KCORE
NAME USER TTYNAME TIME TIME (SECS) (SECS) MIN

-l lineDisplays information about the processes that belong to the workstation whose tty line is specified by the line variable (for example, ttyp0).  The heading format is the same as the default column heading format. 

-m Displays the median amount of process memory used.  If you also specify the −h or −k flag, the −m flag is ignored.  The output format is the same as the default column heading format. 

-n  pattern
Displays information only about the processes whose names include the regular expression specified by the pattern variable.  The output format is the same as the default column heading format. 

select_flag -o filename
Copies selected process records to the specified filename.  The select_flag variable specifies the following process selection flags: −C, -e, -E, -g, -H, -I, -l, -n, -O, -s, -S, and -u.  If you do not specify a selection flag with the select_flag variable, all process records are copied to filename.  The output format includes only the date and time:

ACCOUNTING RECORDS FROM: day mon date hh:mm:ss yy

-O seconds
Displays information about the processes that have a CPU system time exceeding the time specified by the seconds variable.  The output format is the same as the default column heading format. 

-q Displays only the average statistics, which are shown at the end of the command output when you use the −a flag. 

-rDisplays the CPU factor, which is the user time divided by the total CPU time.  The output format is the same as the default column heading format, except the CPU FACTOR column replaces the MEAN SIZE(K) column.  The column heading format is as follows:

ACCOUNTING RECORDS FROM: day mon date hh:mm:ss yy
COMMAND         START  END   REAL    CPU     CPU
NAME USER TTYNAME TIME TIME (SECS) (SECS) FACTOR

-s  time Displays information about the processes that existed on or after time, which is specified as hh[:mm[:ss]].  The column heading format is as follows:

ACCOUNTING RECORDS FROM: day mon date hh:mm:ss yy
END AFTER   : day mon date hh:mm:ss yy
COMMAND         START  END   REAL    CPU     MEAN
NAME USER TTYNAME TIME TIME (SECS) (SECS) SIZE(K)

-S  timeDisplays information only about the processes that started at or after time, which is specified as hh[:mm[:ss]]. The column heading format is as follows:

ACCOUNTING RECORDS FROM: day mon date hh:mm:ss yy
START AFTER : day mon date hh:mm:ss yy
COMMAND         START  END   REAL    CPU     MEAN
NAME USER TTYNAME TIME TIME (SECS) (SECS) SIZE(K)

-t Displays system and user CPU times under separate column headings. The CPU SYS column heading, which shows the system CPU time, replaces the CPU (SECS) default column heading.  The column heading format is as follows:

ACCOUNTING RECORDS FROM: day mon date hh:mm:ss yy
COMMAND    START  END   REAL    CPU  (SECS)
NAME USER TTYNAME TIME TIME (SECS) SYS USER

-u  username
Displays information about the processes that are owned by user username.  You can specify a user identification number, a login name converted to a user identification number, a number sign (#) to specify root or a question mark (?), which selects processes associated with unknown user identification numbers.  The output format is the same as the default column heading format. 

-v Removes column headings from the output; otherwise the output is the same as the default column heading format. 

DESCRIPTION

The acctcom command displays process accounting records from files specified by the file parameter, from standard input, or from the /var/adm/pacct file.  If you do not specify a file and if standard input is assigned to a workstation or to /dev/null (for example, if a process runs in the background), the acctcom command reads the /var/adm/pacct file. 

You do not have to be root to use the acctcom command, which is located in the /usr/bin directory. 

If you specify more than one filename, the acctcom process reads each file chronologically in time-descending order according to process completion time. Usually, the /var/adm/pacct file is used, but you can have several /var/adm/pacct/∗Vn files, which are created by the ckpacct command. 

Each record specifies the execution times for a completed process. The default output format includes the command name, user name, tty name, process start time, process end time, real seconds, CPU seconds, and mean memory size (in kilobytes). The process summary output has the following default column heading format:

ACCOUNTING RECORDS FROM: day mon date hh:mm:ss yyyy
COMMAND                 START  END   REAL    CPU     MEAN
NAME     USER  TTYNAME  TIME   TIME  (SECS)  (SECS)  SIZE(K)

If a specified time is later than the current time, it is interpreted as occurring on the previous day. 

You can use flags to display the state of the fork/exec flag, F column; the system exit value, STAT column; the ratio of total CPU time to elapsed time, HOG FACTOR column; the product of memory used and elapsed time, KCORE MIN column; the ratio of user time to total (system plus user) time, CPU FACTOR column; the number of characters transferred during I/O operations, CHARS TRNSFD column; and the total number of blocks read or written, BLOCKS READ column. 

If a process is run under root or su authority, the command name is prefixed with a number sign (#).  If a process is not assigned to a known tty (for example, if the cron daemon runs the process), a question mark (?) is displayed in the TTYNAME column. 

The acctcom command reports only on processes that have completed. Use the ps command to examine the status of active processes. 

For any flag value that produces a timestamp in an output heading, the order of date and time information is locale dependent.  The timestamps shown in the examples use the default format for date and time values. 

EXAMPLES

The following command displays information about processes that exceed 2.0 seconds of CPU time:

/usr/sbin/acct/acctcom -O 2 < /var/adm/pacct

The following command displays information about processes belonging to the Finance group:

/usr/sbin/acct/acctcom  -g  Finance  <  /var/adm/pacct

The following command displays information about processes belonging to tty /dev/console that run after 5:00 p.m.:

/usr/sbin/acct/acctcom  -l  /dev/console  -s  17:00

FILES

/usr/bin/acctcomSpecifies the command path. 

/var/adm/pacctThe active process accounting database file. 

/etc/passwd, /etc/group
User and group database files.

/usr/include/sys/acct.h, /usr/include/utmp.h
Accounting header files that define formats for writing accounting files.

RELATED INFORMATION

Commands:  ed(1), ps(1), su(1), acct(8), cron(8), runacct(8)

Functions: acct(2)