acctcom(1M)

NAME

acctcom — search and print process accounting files

SYNOPSIS

/usr/sbin/acct/acctcom [[option]... [file]] ...

DESCRIPTION

The acctcom command reads file, standard input, or /var/adm/pacct, in the form described in acct(4) and writes selected records to standard output. Each record represents the execution of one process. The output has the following column titles:

COMMAND NAME
USER
TTYNAME
START TIME
END TIME
REAL (SECS)
CPU (SECS)
MEAN SIZE(K)

Optionally, the following can be displayed:

F: fork()/exec() flag: 1 for fork() without exec()
STAT: System exit status
HOG FACTOR
KCORE MIN
CPU FACTOR
CHARS TRNSFD
BLOCKS READ: Total blocks read and written
PRMID: PRM process resource group ID

The command name is preceded by a # if superuser privileges were required to executed the command.

For example, if a user is logged in as root, and executes the date command to check the time, this does not require superuser privileges, and will be shown by acctcom without the # character on the line. If the user executes the command date 0731180092 to set the time, this requires superuser privileges, and so will be marked with a # by acctcom.

If a process is not associated with a known terminal, a ? is printed in the TTYNAME field.

The system exit status STAT is 0 if the process terminated by calling exit. If it is not 0, it is the signal number that caused the process to terminate. If a core file image was produced as a result of the signal (see signal(5)), the value is the signal number plus 0200.

If no files are specified, and if standard input is associated with a terminal or /dev/null (as is the case when using & in a shell), acctcom reads /var/adm/pacct. Otherwise, it reads standard input.

If any file arguments are given, they are read in their respective order. Each file is normally read forward, that is, in chronological order by process-completion time. The file /var/adm/pacct is usually the current file to be examined. A busy system may need several such files of which all but the current file are found in /var/adm/pacct?.

Options

acctcom recognizes the following values for the option argument. Listing options together has the effect of a logical AND.

-a

Show some average statistics about the processes selected. Statistics are printed after the output records.

-b

Read backwards, showing latest commands first. This option has no effect when standard input is read.

-f

Print in octal the F flag and system exit status columns in the output.

-h

Instead of mean memory size, MEAN SIZE(K), show the fraction of total available CPU time consumed by the process during its execution. This HOG FACTOR is computed as:

total-CPU-time/elapsed-time

-i

Print columns containing the I/O counts in the output.

-k

Instead of memory size, show total kcore-minutes.

-m

Show mean core size (the default).

-P

Show the PRM process resource group ID (PRMID) of each process. See DEPENDENCIES.

-r

Show CPU factor:

user-time/(system-time+user-time)

-t

Show separate system and user CPU times.

-v

Exclude column headings from the output.

-l line

Show only processes belonging to terminal /dev/line.

-u user

Show only processes belonging to user, specified as: a user ID, a login name that is then converted to a user ID, a # which designates only those processes executed with superuser privileges, or ? which designates only those processes associated with unknown user IDs.

-g group

Show only processes belonging to group, specified as either the group ID or group name.

-s time

Select processes existing at or after time, given in the format:

hour[:minute[:second]]

-e time

Select processes existing at or before time; see -s.

Using the same time for both -s and -e shows the processes that existed at time; see -s.

-S time

Select processes starting at or after time; see -s.

-E time

Select processes ending at or before time; see -s.

-n pattern

Show only commands matching pattern, where pattern is a regular expression as in ed(1) except that + means one or more occurrences.

-q

Do not print any output records. Just print the average statistics as with the -a option.

-o ofile

Copy selected process records in the input data format to ofile. Suppress standard output printing.

-H factor

Show only processes that exceed factor, where factor is the "hog factor" as explained in option -h.

-O time

Show only those processes with operating system CPU time exceeding time; see -s.

-C sec

Show only processes with total CPU time, system plus user, exceeding sec seconds.

-I chars

Show only processes transferring more characters than the cut-off number given by chars.

-R prmgroup

Show only processes belonging to process resource group prmgroup, specified as either process resource group name or ID number. See DEPENDENCIES.

WARNINGS

acctcom only reports on processes that have terminated. For active processes, use the ps command (see ps(1)).

If time exceeds the current system clock time, time is interpreted as occurring on the previous day.

The accounting flag is not cleared when one processes exec's another, but only when one process forks another. One side-effect of this is that some processes will be marked with #, when users don't expect them to be.

For example, the login command uses superuser privileges to assume the identity of the user who is logging-in, setting the ASU bit in the accounting flag (which ultimately causes the # symbol in the acctcom output). After assuming the user's identity, login exec's the user's shell. Since the exec does not clear the ASU flag, the shell will inherit it, and be marked with a # in the acctcom output.

DEPENDENCIES

HP Process Resource Manager

The -P and -R options require the optional HP Process Resource Manager (PRM) software to be installed and configured. See prmconfig(1) for a description of how to configure HP PRM, and prmconf(4) for the definition of process resource group.

FILES

/etc/group
/etc/passwd
/var/adm/pacct

STANDARDS CONFORMANCE

acctcom: SVID2, SVID3