System Administration Guide

Looking at the `pacct` File With `acctcom`

At any time, you can examine the contents of the /var/adm/pacctn files, or any file with records in the acct.h format, by using the acctcom program. If you don't specify any files and don't provide any standard input when you run this command, acctcom reads the pacct file. Each record read by acctcom represents information about a dead process (active processes may be examined by running the ps command). The default output of acctcom provides the following information:

Command name (pound (#) sign if it was executed with superuser privileges)
User
tty name (listed as ? if unknown)
Starting time
Ending time
Real time (in seconds)
CPU time (in seconds)
Mean size (in Kbytes)

The following information can be obtained by using options to acctcom:

State of the fork/exec flag (1 for fork without exec)
System exit status
Hog factor
Total kcore minutes
CPU factor
Characters transferred
Blocks read

Table 61-6 describes the acctcom options.

Table 61-6 acctcom Options


Option	Description
`-a`	Show some average statistics about the processes selected. (The statistics are printed after the output is recorded.)
`-b`	Read the files backward, showing latest commands first. (This has no effect if reading standard input.)
`-f`	Print the `fork/exec` flag and system exit status columns. (The output is an octal number.)
`-h`	Instead of mean memory size, show the hog factor, which is the fraction of total available CPU time consumed by the process during its execution. Hog factor = total_CPU_time/elapsed_time.
`-i`	Print columns containing the I/O counts in the output.
`-k`	Show total `kcore` `minutes` instead of memory size.
`-m`	Show mean core size (this is the default).
`-q`	Don't print output records, just print average statistics.
`-r`	Show CPU factor: `user_time`/(`system_time + user_tim`e).
`-t`	Show separate system and user CPU times.
`-v`	Exclude column headings from the output.
`-C` `sec`	Show only processes with total CPU time (system plus user) exceeding `sec` seconds.
`-e` `time`	Show processes existing at or before time, given in the format hr[:min[:sec]].
`-E` `time`	Show processes starting at or before time, given in the format hr[:min[:sec]]. Using the same time for both `-S` and `-E`, show processes that existed at the time.
`-g` `group`	Show only processes belonging to group.
`-H` `factor`	Show only processes that exceed factor, where factor is the "hog factor" (see the `-h` option).
`-I` `chars`	Show only processes transferring more characters than the cutoff number specified by chars.
`-l` `line`	Show only processes belonging to the terminal `/dev/line`.
`-n` `pattern`	Show only commands matching pattern (a regular expression except that "`+`" means one or more occurrences).
`-o` `ofile`	Instead of printing the records, copy them in `acct.h` format to ofile.
`-O` `sec`	Show only processes with CPU system time exceeding sec seconds.
`-s` `time`	Show processes existing at or after time, given in the format `hr`[:`min`[:`sec`]].
`-S` `time`	Show processes starting at or after time, given in the format `hr`[:min[:sec]].
`-u` `user`	Show only processes belonging to user.

Looking at the pacct File With acctcom

Looking at the `pacct` File With `acctcom`