acctcom(1) acctcom(1)
acctcom - search and print process accounting file(s)
acctcom [options<b>] [file <b>. . . ]
acctcom reads file, the standard input, or /var/adm/pacct in the form
described by acct(4) and writes selected records to the standard output.
Each record represents the execution of one process. The output shows
the COMMAND NAME, USER, TTYNAME, START TIME, END TIME, REAL (SEC), CPU
(SEC), MEAN SIZE (K) (see -m option below), and, optionally, F (the
fork/exec flag: 1 for fork without exec), STAT (the system exit status),
HOG FACTOR, KCORE MIN (see -k option below), CPU FACTOR, CHARS TRNSFD,
and BLOCKS READ (total blocks read and written).
A # is prefixed to the command name if the command was executed by a
privileged user. If a process is not associated with a known terminal, a
? is printed in the TTYNAME field.
If no files are specified, and if the standard input is associated with a
terminal or /dev/null (as is the case when using & in the shell),
/var/adm/pacct is read; otherwise, the standard input is read.
If any file arguments are given, they are read in their respective order.
Each file is normally read forward, that is, in chronological order by
process completion time. The file /var/adm/pacct is usually the current
file to be examined; a busy system may need several such files of which
all but the current file are found in /var/adm/pacct incr.
The options are
-a Show some average statistics about the processes selected.
The statistics will be printed after the output records.
-b Read backward, showing latest commands first. This option
has no effect when the standard input is read.
-f Print the fork/exec flag and system exit status columns in
the output. The numeric output for this option will be in
octal.
-h Instead of mean memory size, show the fraction of total
available CPU time consumed by the process during its
execution. This ``hog factor'' is computed as (total
CPU time)/(elapsed time).
-i Print columns containing the I/O counts in the output.
Page 1
acctcom(1) acctcom(1)
-k Instead of memory size, show total kcore-minutes, which is
the average resident set size of the process (in KB) if its
execution time is normalized to one minute. This is computed
by keeping a cumulative sum of the process's resident set
size (the process's current resident set size is added to the
sum HZ times a second). This sum is converted to KB and then
divided by 60*HZ to yield kcore-minutes.
-m Show mean core size (the default). This is average resident
set size of the process (in KB) during its execution. It is
computed by taking the cumulative resident set size (as
computed for the -k option) and dividing it by the sum of the
system and user CPU times.
-r Show CPU factor (user-time/(system-time + user-time)).
-t Show separate system and user CPU times.
-v Exclude column headings from the output.
-l line Show only processes belonging to terminal /dev/line.
-u user Show only processes belonging to user that may be specified
by a user ID, a login name that is then converted to a user
ID, a # that designates only those processes executed by a
privileged user, or a ? that designates only those processes
associated with unknown user IDs. The # and the ? should be
typed as \# and \?, respectively, to prevent the shell from
interpreting the # as the start of a comment or the ? as a
pattern.
-g group Show only processes belonging to the group. The group may be
designated by either the group ID or the group name.
-s time Select processes existing at or after time, given in the
format hr[:min[:sec]].
-e time Select processes existing at or before time.
-S time Select processes starting at or after time.
-E time Select processes ending at or before time. Using the same
time for both -S and -E shows the processes that existed at
time.
-n pattern Show only commands matching pattern that may be a regular
expression, as in regcmp(3G).
-q Do not print any output records, just print the average
statistics, as with the -a option.
Page 2
acctcom(1) acctcom(1)
-o ofile Copy selected process records in the input data format to
ofile; suppress printing to standard output.
-H factor Show only processes that exceed factor, where factor is the
``hog factor'' as explained in option -h above.
-O sec Show only processes with CPU system time exceeding sec
seconds.
-C sec Show only processes with total CPU time (system-time + usertime)
exceeding sec seconds.
-I chars Show only processes transferring more characters than the
cutoff number given by chars.
/etc/passwd
/var/adm/pacctincr
/etc/group
acct(1M), acctcms(1M), acctcon(1M), acctmerg(1M), acctprc(1M),
acctsh(1M), fwtmp(1M), ps(1), runacct(1M), su(1M), acct(2), regcmp(3G),
acct(4), utmp(4).
acctcom reports only on processes that have terminated; use ps(1) for
active processes.
If time exceeds the present time, then time is interpreted as occurring
on the previous day.
PPPPaaaaggggeeee 3333 [ Back ]
|
