acctcom(8)						      System Manager's Manual							acctcom(8)

NAME

       acctcom - Displays selected process accounting record summaries

SYNOPSIS

       /usr/bin/acctcom  [-abfhikmqrtv]  [-C  seconds]	[-e time] [-E time] [-g group] [-H factor] [-I number] [-l line] [select_flag -o file] [-n
       pattern] [-O seconds] [-s time] [-S time] [-u username] [file ...]

FLAGS

       Displays average statistics about the selected processes.  Statistics are displayed at the end of the output records in	the  format  var=#
       (for  example,  CMDS=439),  where  the value (#) is given to the nearest hundredth.  The var specifies the following: Value Total number of
       commands listed in the specified file Average real time per process Average CPU time per process Average user CPU time per process  Average
       system  CPU time per process Average number of characters transferred Average number of blocks transferred Average CPU factor (average user
       time divided by total CPU time) Average hog factor (average CPU time divided by average elapsed time) Displays information about  the  most
       recently executed commands first.  This flag has no effect when the acctcom command reads from the default input device or if more than one
       process accounting file is specified. The column heading format is the same as the default column heading format.   Lists  processes  whose
       total  CPU  time  (system  time	+ user time) is greater than the value specified by seconds.  The column heading format is the same as the
       default column heading format.  Displays information only about processes that start at or before the specified time, which is specified as
       hh[:mm[:ss]].  The column heading format is as follows:

	      ACCOUNTING  RECORDS  FROM:  day mon date hh:mm:ss yy START BEFORE: day mon date hh:mm:ss yy COMMAND	  START  END   REAL    CPU
	      MEAN NAME USER TTYNAME TIME TIME (SECS) (SECS) SIZE(K) Displays information only about processes that end at or before the specified
	      time,  which  is specified as hh[:mm[:ss]].  If you specify the same time for both the -E and -S flags, the acctcom command displays
	      processes that existed at the specified time. The column heading format is as follows:

	      ACCOUNTING RECORDS FROM: day mon date hh:mm:ss yy END BEFORE  : day mon date hh:mm:ss yy COMMAND	       START   END    REAL     CPU
	      MEAN  NAME  USER	TTYNAME  TIME  TIME  (SECS)  (SECS) SIZE(K) Displays information about the fork/exec flag (used to execute another
	      process) in the F column and the system exit value STAT, which can be zero (0) or an error code, in the STAT column in  addition	to
	      the default column heading format.  The column heading format is as follows:

	      ACCOUNTING  RECORDS  FROM:  day mon date hh:mm:ss yy COMMAND		  START  END   REAL    CPU     MEAN NAME USER TTYNAME TIME
	      TIME (SECS) (SECS) SIZE(K) F STAT Displays only the processes that belong to the specified group.  You may specify either the  group
	      ID  or  the group name. The column heading format is the same as the default column heading format.  Displays the hog factor instead
	      of the mean memory size.	The hog factor is the CPU time used by the process divided by the real time.  The output is  the  same	as
	      the  default column format output except the MEAN SIZE(K) column heading is replaced by the .HOG FACTOR heading.	The column heading
	      format is as follows:

	      ACCOUNTING RECORDS FROM: day mon date hh:mm:ss yy COMMAND 	START  END   REAL    CPU      HOG  NAME  USER  TTYNAME	TIME  TIME
	      (SECS)  (SECS)  FACTOR  Displays	information about processes that exceed the value specified by the hogfactor variable.	The output
	      format is the same as the default column heading format.	Displays the number of characters and blocks transferred  during  read	or
	      write I/O operations.  The output is similar to the default column heading format, except the CHARS TRANSFD column replaces the MEAN
	      SIZE(K) column, and the BLOCKS READ column is added to the output.  The column heading format is as follows:

	      ACCOUNTING RECORDS FROM: day mon date hh:mm:ss yy COMMAND   START  END   REAL    CPU     CHARS	BLOCKS NAME USER TTYNAME TIME TIME
	      (SECS)  (SECS)  TRANSFD  READ Displays information about the processes that transfer more than the number of characters specified by
	      the number variable.  The output format is the same as the default column heading format.  Displays the total number of K-core  min-
	      utes,  which  is the number of kilobytes of memory used by the process multiplied by the buffer time used.  The output format is the
	      same as the default column heading format, except the KCORE MIN column heading replaces the MEAN SIZE(K) column heading.	The column
	      heading format is as follows:

	      ACCOUNTING  RECORDS  FROM: day mon date hh:mm:ss yy COMMAND    START  END   REAL	  CPU	  KCORE NAME USER TTYNAME TIME TIME (SECS)
	      (SECS) MIN Displays information about the processes that belong to the workstation whose tty line is specified by the line  variable
	      (for  example,  ttyp0).  The heading format is the same as the default column heading format.  Displays the median amount of process
	      memory used.  If you also specify the -h or -k flag, the -m flag is ignored.  The output format is the same as  the  default  column
	      heading  format.	 Displays information only about the processes whose names include the regular expression specified by the pattern
	      variable.  The output format is the same as the default column heading format.  Copies selected process  records	to  the  specified
	      filename.  The select_flag variable specifies the following process selection flags: -C, -e, -E, -g, -H, -I, -l, -n, -O, -s, -S, and
	      -u.  If you do not specify a selection flag with the select_flag variable, all process records are copied to filename.   The  output
	      format includes only the date and time:

	      ACCOUNTING RECORDS FROM: day mon date hh:mm:ss yy Displays information about the processes that have a CPU system time exceeding the
	      time specified by the seconds variable.  The output format is the same as the default column  heading  format.   Displays  only  the
	      average  statistics,  which  are shown at the end of the command output when you use the -a flag.  Displays the CPU factor, which is
	      the user time divided by the total CPU time.  The output format is the same as the default column heading  format,  except  the  CPU
	      FACTOR column replaces the MEAN SIZE(K) column.  The column heading format is as follows:

	      ACCOUNTING  RECORDS  FROM:  day  mon  date  hh:mm:ss yy COMMAND	      START  END   REAL    CPU	   CPU NAME USER TTYNAME TIME TIME
	      (SECS) (SECS) FACTOR Displays information about the processes that existed on or after time, which  is  specified  as  hh[:mm[:ss]].
	      The column heading format is as follows:

	      ACCOUNTING  RECORDS  FROM:  day mon date hh:mm:ss yy END AFTER   : day mon date hh:mm:ss yy COMMAND	  START  END   REAL    CPU
	      MEAN NAME USER TTYNAME TIME TIME (SECS) (SECS) SIZE(K) Displays information only about the processes that started at or after  time,
	      which is specified as hh[:mm[:ss]]. The column heading format is as follows:

	      ACCOUNTING  RECORDS  FROM:  day mon date hh:mm:ss yy START AFTER : day mon date hh:mm:ss yy COMMAND	  START  END   REAL    CPU
	      MEAN NAME USER TTYNAME TIME TIME (SECS) (SECS) SIZE(K) Displays system and user CPU times under separate column  headings.  The  CPU
	      SYS column heading, which shows the system CPU time, replaces the
	       CPU (SECS) default column heading.  The column heading format is as follows:

	      ACCOUNTING RECORDS FROM: day mon date hh:mm:ss yy COMMAND    START  END	REAL	CPU  (SECS) NAME USER TTYNAME TIME TIME (SECS) SYS
	      USER Displays information about the processes that are owned by user username.  You can specify  a  user	identification	number,  a
	      login  name  converted to a user identification number, a number sign (#) to specify root or a question mark (?), which selects pro-
	      cesses associated with unknown user identification numbers.  The output format is the same as the  default  column  heading  format.
	      Removes column headings from the output; otherwise the output is the same as the default column heading format.

DESCRIPTION

       The  acctcom  command  displays	process  accounting  records  from files specified by the file parameter, from standard input, or from the
       /var/adm/pacct file.  If you do not specify a file and if standard input is assigned to a workstation or to /dev/null (for  example,  if  a
       process runs in the background), the acctcom command reads the /var/adm/pacct file.

       You do not have to be root to use the acctcom command, which is located in the /usr/bin directory.

       If  you	specify  more than one filename, the acctcom process reads each file chronologically in time-descending order according to process
       completion time. Usually, the /var/adm/pacct file is used, but you can have several /var/adm/pacct/*Vn files,  which  are  created  by  the
       ckpacct command.

       Each  record  specifies	the  execution	times for a completed process. The default output format includes the command name, user name, tty
       name, process start time, process end time, real seconds, CPU seconds, and mean memory size (in kilobytes). The process summary output  has
       the following default column heading format:

       ACCOUNTING  RECORDS FROM: day mon date hh:mm:ss yyyy COMMAND		    START  END	 REAL	 CPU	 MEAN NAME     USER  TTYNAME  TIME
       TIME  (SECS)  (SECS)  SIZE(K)

       If a specified time is later than the current time, it is interpreted as occurring on the previous day.

       You can use flags to display the state of the fork/exec flag, F column; the system exit value, STAT column; the ratio of total CPU time	to
       elapsed	time,  HOG  FACTOR  column; the product of memory used and elapsed time, KCORE MIN column; the ratio of user time to total (system
       plus user) time, CPU FACTOR column; the number of characters transferred during I/O operations, CHARS TRNSFD column; and the  total  number
       of blocks read or written, BLOCKS READ column.

       If  a  process  is  run under root or su authority, the command name is prefixed with a number sign (#).  If a process is not assigned to a
       known tty (for example, if the cron daemon runs the process), a question mark (?) is displayed in the TTYNAME column.

       The acctcom command reports only on processes that have completed. Use the ps command to examine the status of active processes.

       For any flag value that produces a timestamp in an output heading, the order of date and time information is locale dependent.	The  time-
       stamps shown in the examples use the default format for date and time values.

EXAMPLES

       The following command displays information about processes that exceed 2.0 seconds of CPU time:

       /usr/sbin/acct/acctcom -O 2 < /var/adm/pacct

       The following command displays information about processes belonging to the Finance group:

       /usr/sbin/acct/acctcom  -g  Finance  <  /var/adm/pacct

       The following command displays information about processes belonging to tty /dev/console that run after 5:00 p.m.:

       /usr/sbin/acct/acctcom  -l  /dev/console  -s  17:00

FILES

       Specifies  the  command	path.	The active process accounting database file.  User and group database files.  Accounting header files that
       define formats for writing accounting files.

RELATED INFORMATION

       Commands:  ed(1), ps(1), su(1), acct(8), cron(8), runacct(8)

       Functions: acct(2) delim off

																	acctcom(8)