acctcom(1)							   User Commands							acctcom(1)

NAME

       acctcom - search and print process accounting files

SYNOPSIS

       acctcom [-abfhikmqrtv] [-C sec] [-e time] [-E time]
	    [-g group] [-H factor] [-I chars] [-l line]
	    [-n pattern] [-o output-file] [-O sec] [-s time]
	    [-S time] [-u user] [filename]...

DESCRIPTION

       The  acctcom  utility  reads  filenames,  the standard input, or /var/adm/pacct, in the form described by acct.h(3HEAD) and writes selected
       records to standard output. Each record represents the execution of one process. The output shows the COMMAND NAME,  USER,  TTYNAME,  START
       TIME,  END  TIME,  REAL (SEC), CPU (SEC), MEAN SIZE (K), and optionally, F (the fork()/exec() flag: 1 for fork() without exec()), STAT (the
       system exit status), HOG FACTOR, KCORE MIN, CPU FACTOR, CHARS TRNSFD, and  BLOCKS READ (total blocks read and written).

       A  `#' is prepended to the command name if the command was executed with super-user privileges. If a process is not associated with a known
       terminal, a  `?' is printed in the TTYNAME field.

       If  no	filename  is specified, and if the standard input is associated with a terminal or /dev/null (as is the case when using `&' in the
       shell), /var/adm/pacct is read; otherwise, the standard input is read.

       If any filename arguments are given, they are read in their respective order. Each file is normally read forward, that is, in chronological
       order  by  process completion time. The file /var/adm/pacct is usually the current file to be examined; a busy system may need several such
       files of which all but the current file are found in /var/adm/pacctincr.

OPTIONS

       The following options are supported:

       -a		 Show some average statistics about the processes selected. The statistics will be printed after the output records.

       -b		 Read backwards, showing latest commands first. This option has no effect when standard input is read.

       -f		 Print the fork()/exec() flag and system exit status columns in the output. The numeric output for this option will be	in
			 octal.

       -h		 Instead  of mean memory size, show the fraction of total available CPU time consumed by the process during its execution.
			 This "hog factor" is computed as (total CPU time)/(elapsed time).

       -i		 Print columns containing the I/O counts in the output.

       -k		 Instead of memory size, show total kcore-minutes.

       -m		 Show mean core size (the default).

       -q		 Do not print any output records, just print the average statistics as with the -a option.

       -r		 Show CPU factor (user-time/(system-time + user-time)).

       -t		 Show separate system and user CPU times.

       -v		 Exclude column headings from the output.

       -C sec		 Show only processes with total CPU time (system-time + user-time) exceeding sec seconds.

       -e time		 Select processes existing at or before time.

       -E time		 Select processes ending at or before time. Using the same time for both -S and -E shows the  processes  that  existed	at
			 time.

       -g group 	 Show only processes belonging to group. The group may be designated by either the group ID or group name.

       -H factor	 Show only processes that exceed factor, where factor is the "hog factor" as explained in option -h above.

       -I chars 	 Show only processes transferring more characters than the cutoff number given by chars.

       -l line		 Show only processes belonging to terminal /dev/term/line.

       -n pattern	 Show  only commands matching pattern that may be a regular expression as in regcmp(3C), except + means one or more occur-
			 rences.

       -o output-file	 Copy selected process records in the input data format to output-file; suppress printing to standard output.

       -O sec		 Show only processes with CPU system time exceeding sec seconds.

       -s time		 Select processes existing at or after time, given in the format hr[:min[:sec]].

       -S time		 Select processes starting at or after time.

       -u user		 Show only processes belonging to user. The user may be specified by a user ID, a login name that is then converted  to  a
			 user  ID,   `#' (which designates only those processes executed with superuser privileges), or `?' (which designates only
			 those processes associated with unknown user IDs).

FILES

       /etc/group	     system group file

       /etc/passwd	     system password file

       /var/adm/pacctincr    active processes accounting file

ATTRIBUTES

       See attributes(5) for descriptions of the following attributes:

       +-----------------------------+-----------------------------+
       |      ATTRIBUTE TYPE	     |	    ATTRIBUTE VALUE	   |
       +-----------------------------+-----------------------------+
       |Availability		     |SUNWaccu			   |
       +-----------------------------+-----------------------------+
       |CSI			     |Enabled			   |
       +-----------------------------+-----------------------------+

SEE ALSO

       ps(1), acct(1M), acctcms(1M), acctcon(1M), acctmerg(1M), acctprc(1M), acctsh(1M),  fwtmp(1M),  runacct(1M),  su(1M),  acct(2),  regcmp(3C),
       acct.h(3HEAD), utmp(4), attributes(5)

       System Administration Guide: Basic Administration

NOTES

       acctcom reports only on processes that have terminated; use ps(1) for active processes.

SunOS 5.11							    11 Jan 1996 							acctcom(1)