System Administration Guide: Advanced Administration

Examining the pacct File With acctcom

At any time, you can examine the contents of the /var/adm/pacctn files, or any file with records in the acct.h format, by using the acctcom program. If you do not specify any files and do not provide any standard input when you run this command, the acctcom command reads the pacct file. Each record read by the acctcom command represents information about a terminated process. Active processes can be examined by running the ps command.

The default output of the acctcom command provides the following information:


# acctcom
COMMAND                           START    END          REAL     CPU    MEAN
NAME       USER     TTYNAME       TIME     TIME       (SECS)  (SECS) SIZE(K)
#accton    root      ?            02:30:01 02:30:01     0.03    0.01  304.00
turnacct   adm       ?            02:30:01 02:30:01     0.42    0.01  320.00
mv         adm       ?            02:30:01 02:30:01     0.07    0.01  504.00
utmp_upd   adm       ?            02:30:01 02:30:01     0.03    0.01  712.00
utmp_upd   adm       ?            02:30:01 02:30:01     0.01    0.01  824.00
utmp_upd   adm       ?            02:30:01 02:30:01     0.01    0.01  912.00
utmp_upd   adm       ?            02:30:01 02:30:01     0.01    0.01  920.00
utmp_upd   adm       ?            02:30:01 02:30:01     0.01    0.01 1136.00
utmp_upd   adm       ?            02:30:01 02:30:01     0.01    0.01  576.00
closewtm   adm       ?            02:30:01 02:30:01     0.10    0.01  664.00

The following list describes each field:

COMMAND NAME

Command name (pound (#) sign if the command was executed with superuser privileges)

USER

User name

TTYNAME

tty name (listed as ? if unknown)

START TIME

Command execution starting time

END TIME

Command execution ending time

REAL (SECS)

Real time (in seconds)

CPU (SECS)

CPU time (in seconds)

MEAN SIZE (K)

Mean size (in Kbytes)

You can obtain the following information by using acctcom command options.

The following list describes the acctcom command options.

-a

Shows average statistics about the processes selected. The statistics are printed after the output is recorded.

-b

Reads the files backward, showing latest commands first. This option has no effect if reading standard input.

-f

Prints the fork/exec flag and system exit status columns. The output is an octal number.

-h

Instead of mean memory size, shows the hog factor, which is the fraction of total available CPU time consumed by the process during its execution. Hog factor = total-CPU-time/elapsed-time.

-i

Prints columns that contains the I/O counts in the output.

-k

Shows total kcore minutes instead of memory size.

-m

Shows mean core size. This size is the default.

-q

Prints average statistics, not output records.

-r

Shows CPU factor: user-time/(system-time + user-time).

-t

Shows separate system and user CPU times.

-v

Excludes column headings from the output.

-C sec

Shows only processes with total CPU time (system plus user) that exceeds sec seconds.

-e time

Shows processes existing at or before time, given in the format hr[:min[:sec]].

-E time

Shows processes starting at or before time, given in the format hr[:min[:sec]]. Using the same time for both -S and -E, shows processes that existed at the time.

-g group

Shows only processes that belong to group.

-H factor

Shows only processes that exceed factor, where factor is the “hog factor” (see the -h option).

-I chars

Shows only processes that transferred more characters than the cutoff number specified by chars.

-l line

Show only processes that belong to the terminal /dev/line.

-n pattern

Shows only commands that match pattern (a regular expression except that “+” means one or more occurrences).

-o ofile

Instead of printing the records, copies them in acct.h format to ofile.

-O sec

Shows only processes with CPU system time that exceeds sec seconds.

-s time

Show processes existing at or after time, given in the format hr[:min[:sec]].

-S time

Show processes starting at or after time, given in the format hr[:min[:sec]].

-u user

Shows only processes that belong to user.