NAME
acctcom — search and print process accounting files
SYNOPSIS
/usr/sbin/acct/acctcom
[[option]... [file]] ...
DESCRIPTION
The
acctcom
command reads
file,
standard input, or
/var/adm/pacct,
in the form described in
acct(4)
and writes selected records to standard output.
Each record represents the execution of one process.
The output has the following column titles:
- COMMAND NAME
- USER
- TTYNAME
- START TIME
- END TIME
- REAL (SECS)
- CPU (SECS)
- MEAN SIZE(K)
Optionally, the following can be displayed:
- F
fork()/exec()
flag:
1
for
fork()
without
exec()
- STAT
System exit status
- HOG FACTOR
- KCORE MIN
- CPU FACTOR
- CHARS TRNSFD
- BLOCKS READ
Total blocks read and written
- PRMID
PRM process resource group ID
The command name is preceded by a
#
if a privileged user is
required
to execute the command.
For example, if a user is logged in as
root,
and executes the
date
command to check the time,
this does not require a privileged user,
and will be shown by
acctcom
without the
#
character on the line.
If the user executes the command
date 0731180092
to set the time, this requires a privileged user, and
so will be marked with a
#
by
acctcom.
If a process is not associated with a known terminal, a
?
is printed in the
TTYNAME
field.
The system exit status
STAT
is
0
if the process terminated by calling
exit.
If it is not
0,
it is the signal number that caused the process to terminate.
If a core file image was produced as a result of the signal (see
signal(5)),
the value is the signal number plus
0200.
If no
files
are specified,
and if standard input is associated with a terminal or
/dev/null
(as is the case when using
&
in a shell),
acctcom
reads
/var/adm/pacct.
Otherwise, it reads standard input.
If any
file
arguments are given, they are read in their respective order.
Each file is normally read forward,
that is, in chronological order by process-completion time.
The file
/var/adm/pacct
is usually the current file to be examined.
A busy system may need several such files
of which all but the current file are found in
/var/adm/pacct[1-9].
Options
acctcom
recognizes the following values for the
option
argument.
Listing options together has the effect of a logical AND.
- -a
Show some average statistics about the processes selected.
Statistics are printed after the output records.
- -b
Read backwards, showing latest commands first.
This option has no effect when standard input is read.
- -f
Print in octal the
F
flag and system exit status columns in the output.
- -h
Instead of mean memory size,
MEAN SIZE(K),
show the fraction of total available CPU time
consumed by the process during its execution.
This
HOG FACTOR
is computed as:
total-CPU-time/elapsed-time
- -i
Print columns containing the I/O counts in the output.
- -k
Instead of memory size, show total kcore-minutes.
- -m
Show mean core size (the default).
- -P
Show the PRM process resource group ID
(PRMID)
of each process.
See DEPENDENCIES.
- -r
Show CPU factor:
user-time/(system-time+user-time)
- -t
Show separate system and user CPU times.
- -v
Exclude column headings from the output.
- -l line
Show only processes belonging to terminal
/dev/line.
- -u user
Show only processes belonging to
user,
specified as: a user ID,
a login name that is then converted to a user ID, a
#
which designates only those processes executed by a privileged user, or
?
which designates only those processes associated with unknown user IDs.
The
#
and
?
characters should be preceded by a backslash
(\)
and typed as
\#
and
\?
to prevent the shell
from interpreting the
#
as the start of a comment, or the
?
as a pattern.
- -g group
Show only processes belonging to
group,
specified as either the group ID or group name.
- -s time
Select processes existing at or after
time,
given in the format:
- -e time
Select processes existing at or before
time;
see
-s.
Using the same
time
for both
-s
and
-e
shows the processes that existed at
time;
see
-s.
- -S time
Select processes starting at or after
time;
see
-s.
- -E time
Select processes ending at or before
time;
see
-s.
- -n pattern
Show only commands matching
pattern,
where
pattern
is a regular expression as in
ed(1)
except that
+
means one or more occurrences.
- -q
Do not print any output records.
Just print the average statistics as with the
-a
option.
- -o ofile
Copy selected process records in the input data format to
ofile.
Suppress standard output printing.
- -H factor
Show only processes that exceed
factor,
where
factor
is the "hog factor" as explained in option
-h.
- -O time
Show only those processes with operating system CPU time exceeding
time;
see
-s.
- -C sec
Show only processes with total CPU time, system plus user, exceeding
sec
seconds.
- -I chars
Show only processes transferring more characters
than the cut-off number given by
chars.
- -R prmgroup
Show only processes belonging to process resource group
prmgroup,
specified as either process resource group name or ID number.
See DEPENDENCIES.
WARNINGS
acctcom
only reports on processes that have terminated.
For active processes, use
the
ps
command (see
ps(1)).
If
time
exceeds the current system clock time,
time
is interpreted as occurring on the previous day.
The accounting flag is not cleared when one processes exec's another,
but only when one process forks another. One side-effect of this is that
some processes will be marked with
#,
when users do not expect them to be.
For example, the
login
command requires a privileged user
to assume the identity of the user who is logging-in,
setting the ASU bit in the accounting flag
(which ultimately causes the
#
symbol in the
acctcom
output).
After assuming the user's identity,
login
exec's the user's shell.
Since the exec does not clear the ASU flag,
the shell will inherit it, and be marked with a
#
in the
acctcom
output.
The mean memory size may overflow for values greater than
MAXINT.
DEPENDENCIES
HP Process Resource Manager
The
-P
and
-R
options require
the optional HP Process Resource Manager (PRM) software
to be installed and configured.
See
prmconfig(1)
for a description of how to configure HP PRM,
and
prmconf(4)
for the definition of process resource group.
FILES
/etc/group
/etc/passwd
/var/adm/pacct
SEE ALSO
ps(1),
su(1),
acct(1M),
acctcms(1M),
acctcon(1M),
acctmerg(1M),
acctprc(1M),
acctsh(1M),
fwtmp(1M),
runacct(1M),
acct(2),
wait(2),
acct(4),
utmp(4),
signal(5).
HP Process Resource Manager:
prmconfig(1),
prmconf(4)
in
HP Process Resource Manager User's Guide.
STANDARDS CONFORMANCE
acctcom: SVID2, SVID3
Printable version
