ACCTCOM(1) General Commands Manual ACCTCOM(1)
acctcom - search and print process accounting files
acctcom [ -abfhikmqrtv ] [ -C sec ] [ -e time ] [ -E time ]
[ -g group ] [ -H factor ] [ -I chars ] [ -l line ]
[ -n pattern ] [ -o output-file ] [ -O sec ]
[ -s time ] [ -S time ] [ -u user ]
acctcom reads filename, the standard input, or /var/adm/pacct, in the
form described by acct(5) and writes selected records to the standard
output. Each record represents the execution of one process. The out-
put shows the COMMAND NAME, USER, TTYNAME, START TIME, END TIME, REAL
(SEC), CPU (SEC), MEAN SIZE(K), and optionally, F (the fork/exec flag:
1 for fork() without exec()), STAT (the system exit status), HOG FAC-
TOR, KCORE MIN, CPU FACTOR, CHARS TRNSFD, and BLOCKS READ (total blocks
read and written).
A `#' is prepended to the command name if the command was executed with
super-user privileges. If a process is not associated with a known
terminal, a `?' is printed in the TTYNAME field.
If no filenames are specified, and if the standard input is associated
with a terminal or /dev/null (as is the case when using `&&' in the
shell), /var/adm/pacct is read; otherwise, the standard input is read.
If any filename arguments are given, they are read in their respective
order. Each file is normally read forward, that is, in chronological
order by process completion time. The file /var/adm/pacct is usually
the current file to be examined; a busy system may need several such
files of which all but the current file are found in /var/adm/pacct?.
-a Show some average statistics about the processes selected.
The statistics will be printed after the output records.
-b Read backwards, showing latest commands first. This option
has no effect when the standard input is read.
-f Print the fork/exec flag and system exit status columns in
the output. The numeric output for this option will be in
-h Instead of mean memory size, show the fraction of total
available CPU time consumed by the process during its exe-
cution. This "hog factor" is computed as:
(total CPU time)/(elapsed time)
-i Print columns containing the I/O counts in the output.
-k Instead of memory size, show total kcore-minutes.
-m Show mean core size (the default).
-q Do not print any output records, just print the average
statistics as with the -a option.
-r Show CPU factor (user time/(system-time + user-time).
-t Show separate system and user CPU times.
-v Exclude column headings from the output.
-C sec Show only processes with total CPU time, system plus user,
exceeding sec seconds.
-e time Select processes existing at or before time.
-E time Select processes ending at or before time. Using the same
time for both -S and -E shows the processes that existed at
-g group Show only processes belonging to group. The group may be
designated by either the group ID or group name.
-H factor Show only processes that exceed factor, where factor is the
"hog factor" as explained in the -h option above.
-I chars Show only processes transferring more characters than the
cutoff number given by chars.
-l line Show only processes belonging to terminal /dev/line.
-n pattern Show only commands matching pattern that may be a regular
expression as in regexp(3).
-o ofile Copy selected process records in the input data format to
ofile; suppress standard output printing.
-O sec Show only processes with CPU system time exceeding sec sec-
-s time Select processes existing at or after time, given in the
-S time Select processes starting at or after time.
-u user Show only processes belonging to user that may be specified
by: a user ID, a login name that is then converted to a
user ID, a `#', which designates only those processes exe-
cuted with super-user privileges, or `?', which designates
only those processes associated with unknown user IDs.
ps(1), su(1V) acct(2V), regexp(3), acct(5), utmp(5V), acct(8),
acctcms(8), acctcon(8), acctmerg(8), acctprc(8), acctsh(8), fwtmp(8),
acctcom reports only on processes that have terminated; use ps(1) for
active processes. If time exceeds the present time, then time is
interpreted as occurring on the previous day.
12 January 1990 ACCTCOM(1)