acctcom - search and print process accounting files
acctcom [-abfhikmqrtv] [-C sec] [-e time] [-E time] [-
g group] [-H factor] [-I chars] [-l line] [-n pattern] [-
o output-file] [-O sec] [-s time] [-S time] [-u user]
The acctcom utility reads filenames, the standard input, or
/var/adm/pacct, in the form described by acct(3HEAD) and
writes selected records to standard output. Each record
represents the execution of one process. The output shows
the COMMAND NAME, USER, TTYNAME, START TIME, END TIME, REAL
(SEC), CPU (SEC), MEAN SIZE (K), and optionally, F (the
fork()/exec() flag: 1 for fork() without exec()), STAT (the
system exit status), HOG FACTOR, KCORE MIN, CPU FACTOR,
CHARS TRNSFD, and BLOCKS READ (total blocks read and writ-
A `#' is prepended to the command name if the command was
executed with super-user privileges. If a process is not
associated with a known terminal, a `?' is printed in the
If no filename is specified, and if the standard input is
associated with a terminal or /dev/null (as is the case when
using `&' in the shell), /var/adm/pacct is read; otherwise,
the standard input is read.
If any filename arguments are given, they are read in their
respective order. Each file is normally read forward, that
is, in chronological order by process completion time. The
file /var/adm/pacct is usually the current file to be exam-
ined; a busy system may need several such files of which all
but the current file are found in /var/adm/pacctincr.
The following options are supported:
-a Show some average statistics about the processes
selected. The statistics will be printed after the
-b Read backwards, showing latest commands first. This
option has no effect when standard input is read.
-f Print the fork()/exec() flag and system exit status
columns in the output. The numeric output for this
option will be in octal.
-h Instead of mean memory size, show the fraction of
total available CPU time consumed by the process dur-
ing its execution. This "hog factor" is computed as
(total CPU time)/(elapsed time).
-i Print columns containing the I/O counts in the output.
-k Instead of memory size, show total kcore-minutes.
-m Show mean core size (the default).
-q Do not print any output records, just print the aver-
age statistics as with the -a option.
-r Show CPU factor (user-time/(system-time + user-time)).
-t Show separate system and user CPU times.
-v Exclude column headings from the output.
Show only processes with total CPU time (system-time +
user-time) exceeding sec seconds.
Select processes existing at or before time.
Select processes ending at or before time. Using the
same time for both -S and -E shows the processes that
existed at time.
Show only processes belonging to group. The group may
be designated by either the group ID or group name.
Show only processes that exceed factor, where factor
is the "hog factor" as explained in option -h above.
Show only processes transferring more characters than
the cutoff number given by chars.
Show only processes belonging to terminal
Show only commands matching pattern that may be a reg-
ular expression as in regcmp(3C), except + means one
or more occurrences.
Copy selected process records in the input data format
to output-file; suppress printing to standard output.
Show only processes with CPU system time exceeding sec
Select processes existing at or after time, given in
the format hr[:min[:sec]].
Select processes starting at or after time.
Show only processes belonging to user. The user may be
specified by a user ID, a login name that is then con-
verted to a user ID, `#' (which designates only those
processes executed with superuser privileges), or `?'
(which designates only those processes associated with
unknown user IDs).
system group file
system password file
active processes accounting file
See attributes(5) for descriptions of the following attri-
| ATTRIBUTE TYPE | ATTRIBUTE VALUE |
| Availability | SUNWaccu |
| CSI | enabled |
ps(1), acct(1M), acctcms(1M), acctcon(1M), acctmerg(1M),
acctprc(1M), acctsh(1M), fwtmp(1M), runacct(1M), su(1M),
acct(2), regcmp(3C), acct(3HEAD), utmp(4), attributes(5)
System Administration Guide: Basic Administration
acctcom reports only on processes that have terminated; use
ps(1) for active processes.
Man(1) output converted with