DOC HOME SITE MAP MAN PAGES GNU INFO SEARCH
 

acctcom(ADM)


acctcom -- search and print process accounting file(s)

Syntax

acctcom [ options ] [ files ]

Description

acctcom reads file, the standard input, or /usr/adm/pacct, in the form described by acct(FP) and writes selected records to the standard output. Each record represents the execution of one process. The output shows the COMMAND Name, USER, TTYName, START TIME, END TIME, REAL(SEC), CPU(SEC), MEAN SIZE(K), and optionally, F (the fork/exec flag: 1 for fork without exec), STAT (the system exit status), HOG FACTOR, KCORE MIN, CPU FACTOR, CHARS TRNSFD and BLOCKS READ (total blocks read and written).

The command name is prepended with a ``#'' if it was executed with super user privileges. If a process is not associated with a known terminal, a ``?'' is printed in the TTYName field.

If no files are specified, and if the standard input is associated with a terminal or /dev/null (as is the case when using ``&'' in the shell), acctcom reads /usr/adm/pacct; otherwise, it reads the standard input.

If any file arguments are given, acctcom reads them in the order that they are specified. Normally, acctcom reads each file forward, that is, in chronological order by process completion time. acctcom usually examines /usr/adm/pacct as the current file; a busy system may need several such files of which all but the current file are found in /usr/adm/pacct?.

acctcom takes the following options:


-a
Show some average statistics about the processes selected. The statistics will be printed after the output records.

-b
Read backwards, showing latest commands first. This option has no effect when the standard input is read.

-C sec
Show only processes with total CPU time, system plus user, exceeding sec seconds.

-e time
Select processes existing at or before time. time has the format:

hh[:mm[:ss]]

hh is the hour (00-23), mm is the minute (00-59), and ss is the second (00-59). The default value for both mm and ss is 00.


-E time
Select processes ending at or before time. See the description for -e for the format of time. Using the same time for both -S and -E shows the processes that existed at time.

-f
Print the fork/exec flag and system exit status columns in the output.

-g group
Show only processes belonging to group. The group may be designated by either the group ID or group name.

-h
Instead of mean memory size, show the fraction of total available CPU time consumed by the process during its execution. This ``hog factor'' is computed as:

(total CPU time)/(elapsed time).


-H factor
Show only processes that exceed factor, where factor is the ``hog factor'' as explained in option -h above.

-i
Print columns containing the I/O counts in the output.

-I chars
Show only processes transferring more characters than the cut-off number given by chars.

-k
Instead of memory size, show total kcore-minutes.

-l line
Show only processes belonging to terminal /dev/line.

-m
Show mean core size (the default).

-n pattern
Exclude commands matching pattern that may be an Extended Regular Expression (ERE as defined in regexp(M)).

-o ofile
Copy selected process records in the input data format to ofile; suppress standard output printing.

-O sec
Show only processes with CPU system time exceeding sec seconds.

-q
Do not print any output records; just print the average statistics as with the -a option.

-r
Show CPU factor: user time/(system-time + user-time).

-s time
Select processes existing at or after time. See the description for -e for the format of time.

-S time
Select processes starting at or after time. See the description for -e for the format of time.

-t
Show separate system and user CPU times.

-u user
Show only processes belonging to user that may be specified by: a user ID, a login name that is then converted to a user ID, a ``#'' which designates only those processes executed with super user privileges, or ``?'' which designates only those processes associated with unknown user IDs.

-v
Exclude column headings from the output.

Limitations

acctcom reports only on processes that have terminated; use ps(C) for active processes. If time exceeds the present time, then time is interpreted as occurring on the previous day.

Files

/etc/passwd
/usr/adm/pacct
/etc/group

See also

acct(ADM), acct(S), acct(FP), acctcms(ADM), acctcon(ADM), acctmerg(ADM), acctprc(ADM), acctsh(ADM), fwtmp(ADM), ps(C), regexp(M), runacct(ADM), su(C), utmp(F)

Standards conformance

acctcom is conformant with AT&T SVID Issue 2.
© 2003 Caldera International, Inc. All rights reserved.
SCO OpenServer Release 5.0.7 -- 11 February 2003