acctcom(1)

NAME

     acctcom - search and print process accounting files

SYNOPSIS

     acctcom  [-abfhikmqrtv]  [-C sec]  [-e time]  [-E time]   [-
     g group]  [-H factor]  [-I chars]  [-l line] [-n pattern] [-
     o output-file]  [-O sec]   [-s time]   [-S time]   [-u user]
     [filename...]

DESCRIPTION

     The acctcom utility reads filenames, the standard input,  or
     /var/adm/pacct,  in  the  form  described by acct(3HEAD) and
     writes selected records  to  standard  output.  Each  record
     represents  the  execution  of one process. The output shows
     the COMMAND NAME, USER, TTYNAME, START TIME, END TIME,  REAL
     (SEC),  CPU  (SEC),  MEAN  SIZE  (K), and optionally, F (the
     fork()/exec() flag: 1 for fork() without exec()), STAT  (the
     system  exit  status),  HOG  FACTOR,  KCORE MIN, CPU FACTOR,
     CHARS TRNSFD, and  BLOCKS READ (total blocks read and  writ-
     ten).

     A  `#' is prepended to the command name if the  command  was
     executed  with  super-user  privileges.  If a process is not
     associated with a known terminal, a  `?' is printed  in  the
     TTYNAME field.

     If no  filename is specified, and if the standard  input  is
     associated with a terminal or /dev/null (as is the case when
     using `&' in the shell), /var/adm/pacct is read;  otherwise,
     the standard input is read.

     If any filename arguments are given, they are read in  their
     respective  order.  Each file is normally read forward, that
     is, in chronological order by process completion time.   The
     file  /var/adm/pacct is usually the current file to be exam-
     ined; a busy system may need several such files of which all
     but the current file are found in /var/adm/pacctincr.

OPTIONS

     The following options are supported:

     -a    Show  some  average  statistics  about  the  processes
           selected.  The  statistics  will  be printed after the
           output records.

     -b    Read backwards, showing latest  commands  first.  This
           option has no effect when standard input is read.

     -f    Print the fork()/exec() flag and  system  exit  status
           columns  in  the  output.  The numeric output for this
           option will be in octal.

     -h    Instead of mean memory  size,  show  the  fraction  of
           total  available CPU time consumed by the process dur-
           ing its execution. This "hog factor"  is  computed  as
           (total CPU time)/(elapsed time).

     -i    Print columns containing the I/O counts in the output.

     -k    Instead of memory size, show total kcore-minutes.

     -m    Show mean core size (the default).

     -q    Do not print any output records, just print the  aver-
           age statistics as with the -a option.

     -r    Show CPU factor (user-time/(system-time + user-time)).

     -t    Show separate system and user CPU times.

     -v    Exclude column headings from the output.

     -C sec
           Show only processes with total CPU time (system-time +
           user-time) exceeding sec seconds.

     -e time
           Select processes existing at or before time.

     -E time
           Select processes ending at or before time.  Using  the
           same  time for both -S and -E shows the processes that
           existed at time.

     -g group
           Show only processes belonging to group. The group  may
           be designated by either the group ID or group name.

     -H factor
           Show only processes that exceed factor,  where  factor
           is the "hog factor" as explained in option -h above.

     -I chars
           Show only processes transferring more characters  than
           the cutoff number given by chars.

     -l line
           Show   only   processes    belonging    to    terminal
           /dev/term/line.

     -n pattern
           Show only commands matching pattern that may be a reg-
           ular  expression  as in regcmp(3C), except + means one
           or more occurrences.

     -o output-file
           Copy selected process records in the input data format
           to output-file; suppress printing to standard output.

     -O sec
           Show only processes with CPU system time exceeding sec
           seconds.

     -s time
           Select processes existing at or after time,  given  in
           the format hr[:min[:sec]].

     -S time
           Select processes starting at or after time.

     -u user
           Show only processes belonging to user. The user may be
           specified by a user ID, a login name that is then con-
           verted to a user ID,  `#' (which designates only those
           processes  executed with superuser privileges), or `?'
           (which designates only those processes associated with
           unknown user IDs).

FILES

     /etc/group
           system group file

     /etc/passwd
           system password file

     /var/adm/pacctincr
           active processes accounting file

ATTRIBUTES

     See attributes(5) for descriptions of the  following  attri-
     butes:

     ____________________________________________________________
    |       ATTRIBUTE TYPE        |       ATTRIBUTE VALUE       |
    |_____________________________|_____________________________|
    | Availability                | SUNWaccu                    |
    |_____________________________|_____________________________|
    | CSI                         | enabled                     |
    |_____________________________|_____________________________|

SEE ALSO

     ps(1),  acct(1M),  acctcms(1M),  acctcon(1M),  acctmerg(1M),
     acctprc(1M),  acctsh(1M),  fwtmp(1M),  runacct(1M),  su(1M),
     acct(2), regcmp(3C), acct(3HEAD), utmp(4), attributes(5)

     System Administration Guide: Basic Administration

NOTES

     acctcom reports only on processes that have terminated;  use
     ps(1) for active processes.