OSF

NAME

acctcom − Outputs selected process accounting record summaries

SYNOPSIS

acctcom [-q | -o file] [-abhikmrtv] [-C seconds] [-g group] [-H factor] [-I number] [-l line] [-n pattern] [-O seconds] [-u user] [-e time] [-E time] [-s time] [-S time] [file ...]

The acctcom command reads process accounting records from files specified by the file parameter from standard input or from the /var/adm/pacct file. Records from the specified input source are written to the default output device. 

FLAGS

-aLists average statistics about the processes selected.  Statistics are displayed at the end of the output records in the format var=val (where var is the listed variable and val is a numerical value to the nearest hundreth) and in the listed order. 

VariableValue

CMDSThe total number of commands listed in the named file(s). 

REALAverage real time per process. 

CPUAverage CPU time per process. 

USERAverage user CPU time per process. 

SYSAverage system CPU time per process. 

CHARAverage number of characters transferred. 

BLKAverage number of blocks transferred. 

USR/TOTAverage CPU factor (average user time divided by total CPU time). 

HOGAverage hog factor (average CPU time divided by average elapsed time). 

-bLists backward in time-ascending order, showing the most recent commands first. This flag has no effect when the acctcom command reads from the default input device. The column heading format is the same as the default column heading format. 

-C secondsLists processes whose total CPU time (system time + user time) exceeds seconds. The column heading format is the same as the default column heading format. 

-e timeLists processes starting at or before the specified START BEFORE time.  You may use the NLTIME environment variable to specify the order of hours, minutes, and seconds. The default order is hh:mm:ss.  The column heading format is as follows:

ACCOUNTING RECORDS FROM: day mon date hh:mm:ss yy
START BEFORE: day mon date hh:mm:ss yy
COMMAND                  START  END   REAL    CPU     MEAN
NAME      USER  TTYNAME  TIME   TIME  (SECS)  (SECS)  SIZE(K)

-E timeLists processes ending at or before the specified END BEFORE time.  You may use the NLTIME environment variable to specify the order of hours, minutes, and seconds. The default order is hh:mm:ss.  When you specify the same time for both the -E and -S flags, the acctcom command displays processes that existed at the specified time. The column heading format is as follows:

ACCOUNTING RECORDS FROM: day mon date hh:mm:ss yy
END BEFORE  : day mon date hh:mm:ss yy
COMMAND                  START  END   REAL    CPU     MEAN
NAME      USER  TTYNAME  TIME   TIME  (SECS)  (SECS)  SIZE(K)

-fAdds columns to list the state of the fork/exec flag F (means of executing another process) and the system exit value STAT (0 or an error code) in the output by adding F and STAT columns, respectively, to the output column headings. The column heading format is as follows:

ACCOUNTING RECORDS FROM: day mon date hh:mm:ss yy
COMMAND                  START  END   REAL    CPU     MEAN
NAME      USER  TTYNAME  TIME   TIME  (SECS)  (SECS)  SIZE(K)  F  STAT

-g groupLists processes belonging to group. You may specify either the group ID or the group name. The column heading format is the same as the default column heading format. 

-hThe MEAN SIZE(K) column heading is replaced with the HOG FACTOR heading to list the fraction of total available CPU time consumed by the process (see HOG below). The column heading format is as follows:

ACCOUNTING RECORDS FROM: day mon date hh:mm:ss yy
COMMAND                  START  END   REAL    CPU     HOG
NAME      USER  TTYNAME  TIME   TIME  (SECS)  (SECS)  FACTOR

-H  hogfactor
Lists processes that exceed hogfactor. The column heading format is the same as the default column heading format. 

-i The MEAN SIZE(K) column heading is replaced with the CHARS TRANSFD heading to list the number of characters transferred during read or write I/O operations. The BLOCKS READ column is added to list the number of blocks transferred. The column heading format is as follows:

ACCOUNTING RECORDS FROM: day mon date hh:mm:ss yy
COMMAND                  START  END   REAL    CPU     CHARS    BLOCKS
NAME      USER  TTYNAME  TIME   TIME  (SECS)  (SECS)  TRANSFD  READ

-InumberLists processes transferring more than number characters. The column heading format is the same as the default column heading format. 

-kThe MEAN SIZE(K) column heading is replaced with the KCORE MIN heading to list the total K-core minutes.  The column heading format is as follows:

ACCOUNTING RECORDS FROM: day mon date hh:mm:ss yy
COMMAND                  START  END   REAL    CPU     KCORE
NAME      USER  TTYNAME  TIME   TIME  (SECS)  (SECS)  MIN

-l lineLists only processes belonging to workstation /dev/line. The column heading format is the same as the default column heading format. 

-m Lists mean process memory used.  The -h flag or -k flag turns off the -m flag. The column heading format is the same as the default column heading format. 

-n  pattern Lists all commands matching pattern, where pattern is a regular expression, similar to those use with the ed command.  The column heading format is the same as the default column heading format. 

selflag -o file Copies all selflag process records to file in the acct binary format. The selflag process records are those that can be selected using the -C, -e,-E, -g, -H, -I, -l, -n, -O, -s, -S, and -u flags.  If no selflag is specified, all process records are copied. No column heading format is printed except the date and time the accounting records are taken from. 

ACCOUNTING RECORDS FROM: day mon date hh:mm:ss yy

-O seconds Lists processes with CPU system time exceeding seconds. The column heading format is the same as the default column heading format. 

-q Does not produce a listing. Only outputs the average statistics that are produced at the end of a listing when the -a flag is used. 

-rLists CPU factor. The default heading MEAN SIZE(K) column is changed to CPU FACTOR (see USR/TOT).  The column heading format is as follows:

ACCOUNTING RECORDS FROM: day mon date hh:mm:ss yy
COMMAND                 START  END   REAL    CPU     CPU
NAME     USER  TTYNAME  TIME   TIME  (SECS)  (SECS)  FACTOR

-s  time Lists only those processes that existed on or after the specified END AFTER time. You can use the NLTIME environment variable to specify the order of hours, minutes, and seconds. The default order is hh:mm:ss. The column heading format is as follows:

ACCOUNTING RECORDS FROM: day mon date hh:mm:ss yy
END AFTER   : day mon date hh:mm:ss yy
COMMAND                  START  END   REAL    CPU     MEAN
NAME      USER  TTYNAME  TIME   TIME  (SECS)  (SECS)  SIZE(K)

-S  timeList only those processes starting at or after the specified START AFTER time.  You can use the NLTIME environment variable to specify the order of hours, minutes, and seconds. The default timestamp order is hh:mm:ss.  The column heading format is as follows:

ACCOUNTING RECORDS FROM: day mon date hh:mm:ss yy
START AFTER : day mon date hh:mm:ss yy
COMMAND                  START  END   REAL    CPU     MEAN
NAME      USER  TTYNAME  TIME   TIME  (SECS)  (SECS)  SIZE(K)

-t Lists system and user CPU times under separate headings. The default column CPU (SECS) is changed to CPU SYS and lists the system CPU time. The default column MEAN SIZE(K) is changed to (SECS) USER and lists user CPU time. The column heading format is as follows:

ACCOUNTING RECORDS FROM: day mon date hh:mm:ss yy
COMMAND                  START  END   REAL    CPU  (SECS)
NAME      USER  TTYNAME  TIME   TIME  (SECS)  SYS  USER

-u  user Lists processes belonging to user; a user ID, a login name that is converted to a user ID, a # (number sign) to select processes run by the root user, or a ? (question mark) to select processes associated with unknown user IDs.  The column heading format is the same as the default column heading format. 

-v Eliminates column headings from the output. The column format is the same as the default column format. 

DESCRIPTION

The acctcom command reads process accounting records from files specified by the file(s) parameter from standard input or from the /var/adm/pacct file. Records from the specified input source are written to the default output device. 

The use of this command is not restricted to individuals with administrative authority. The acctcom command is stored in the /usr/bin directory for accessiblity to most users. When you do not specify a file(s) parameter and standard input is assigned to a workstation or to /dev/null (when a process runs in the background, for example), the acctcom command reads the /var/adm/pacct file. 

When you specify file(s), the acctcom process reads each file chronologically in time-descending order according to process completion time. Usually /var/adm/pacct is the current file that acctcom writes to the default output device. Because the ckpacct procedure keeps this file from growing too large, a busy system may have several pacct files. All but the current file has the following pathname: /var/adm/pacctn, where n is a unique integer whose value is assigned to any additional /var/adm/pacctn files in the order they are created. 

Each record represents execution times for one completed process. The default output format includes the command name, username, tty name, process start time, process end time, real seconds, CPU seconds, and mean memory size (in kilobytes). The process summary output has the following default column heading format:

ACCOUNTING RECORDS FROM: day mon date hh:mm:ss yy
COMMAND                 START  END   REAL    CPU     MEAN
NAME     USER  TTYNAME  TIME   TIME  (SECS)  (SECS)  SIZE(K)

The date and timestamp format is day mon date hh:mm:ss yy where day is the day of the week, mon is the month, hh:mm:ss is the time expressed in hours (in 24-hour clock notation), minutes, and seconds, and yy is the year expressed as four digits. 

By using appropriate flags, you may also output the state of the fork/exec flag, F; the system exit value, STAT; the ratio of total CPU time to elapsed time, HOG FACTOR; the product of memory used and elapsed time, KCORE MIN; the ratio of user time to total (system plus user) time, CPU FACTOR; the number of characters transferred during I/O operations, CHARS TRNSFD; and the total number of blocks read or written, BLOCKS READ. 

Whenever a process is run under root or su authority, the command name is prefixed with a # (number sign). When a process is not assigned to a known tty; for example, when the cron daemon runs the process, a ? (question mark) is written in the TTYNAME column. 

The acctcom command only reports on processes that have completed. Use the ps command to examine the status of active processes.  When a specified time is later than the current time, it is interpreted as occurring on the previous day. 

For any flag value that produces a date and timestamp in an output heading, the order of date and time information is locale dependent.  The date and timestamps shown in the examples are for the default headings, but their order may be changed using the NLTIME environment variable to change the timestamp format. 

EXAMPLES

     1.To display information about processes that exceed 2.0 seconds of CPU time, enter:

/usr/sbin/acct/acctcom -O 2 < /var/adm/pacct

The process information is read from the /var/adm/pacct file. 

     2.To display information about processes belonging to the Finance group, enter:

/usr/sbin/acct/acctcom  -g  Finance  <  /var/adm/pacct

The process information is read from the /var/adm/pacct file. 

     3.To display information about processes belonging to tty /dev/console that run after 5:00 p.m., enter:

/usr/sbin/acct/acctcom  -l  /dev/console  -s  17:00

The process information is read from the /var/adm/pacct file by default. 

FILES

/usr/sbin/acct/acctcom
Specifies the command path

/var/adm/pacct
The active process accounting database file.

/etc/passwd, /etc/group
User and group database files.

/usr/include/sys/acct.h, /usr/include/utmp.h
Accounting header files that define formats for writing accounting files.

RELATED INFORMATION

Commands:  acct(8), ed(8), ps(8), runacct(8), su(1)

Daemons:  cron(8)

Functions: acct(2)