Solaris

I want to investigate why CPU utilization was high yesterday on my solaris 10 machine.
I have been reported this problem but how can I investigate why CPU utilization went high at that time?

if you collect performance data with SAR or an other product you can check this data... if you don't collect any data, it won't be possible (as far as i know) to check why something happened a while ago...

Inside Solaris / Configuring sar for your system

sar can only tell you that it was high or not, not why.

Unfortunately the only way i know is to be on the system at the time of high utilisation and run commands such as top to see what processes are using CPU.

I would suggest you ask users what they were doing to see if they were doing anything CPU intensive on the box at the time, whether they know it or not. Check cron jobs to see if any kick off around the time of high CPU usage could have caused it, but still you cant get a positive answer just might give you a rough guide on what may have affected your server.

maybe check your last command to see who was logged in at the time as well?

How about process accounting? Was it enabled?

How do I check if it is enabled?
ps -ef|grep -i acc shows nothing

svcs -v|grep -i acc shows

legacy_run - Apr_29 70 lrc:/etc/rc2_d/S22acct
legacy_run - Apr_29 89 lrc:/etc/rc2_d/S99AccountingDaemon

acctcom |less shows
COMMAND START END REAL CPU MEAN
NAME USER TTYNAME TIME TIME (SECS) (SECS) SIZE(K)
#accton root ? 10:07:00 10:07:00 0.01 0.01 1240.00
sh root ? 10:07:00 10:07:00 0.01 0.01 1328.00