acctcom Command

Purpose

Displays summaries of process-accounting records for selected processes.

Syntax

/usr/sbin/acct/acctcom [ [ -q | -o File ] | [ -a ] [ -b ] [ -c Classname ] [-f ] [ -h ] [ -i ] [ -k ] [ -m ] [ -r ] [ -t ] [ -v ] [ -w [ -X ] [ -W ]] [ -C Seconds ] [ -g Group ] [ -H Factor ] [ -I Number ] [ -l Line ] [ -n Pattern ] [ -O Seconds ] [ -u User ] [ -e Time ] [ -E Time ] [ -s Time ] [ -S Time ] [ -@ [ WparName ] ] [ File ... ]

Description

The acctcom command reads process accounting records from files specified by the File parameter from standard input or from the /var/adm/pacct file. Then the acctcom command writes the records you request to standard output. This command is stored in the /usr/sbin/acct directory, for access by all users.

If you do not specify a File parameter and if standard input is assigned to a workstation or to the /dev/null file, as when a process runs in the background, the acctcom command reads the /var/adm/pacct file.

If you specify a File parameter, the acctcom command reads each file chronologically by process completion time. Usually, the /var/adm/pacct file is the current file that you want the acctcom command to examine. Because the ckpacct procedure keeps this file from growing too large, a busy system may have several pacct files. All but the current file have the path name /var/adm/pacct?, where ? (question mark) represents an integer.

Each record represents one completed process. The default display consists of the command name, user name, tty name, start time, end time, real seconds, CPU seconds, and mean memory size (in kilobytes). These default items have the following headings in the output:

COMMAND                    START   END    REAL    CPU     MEAN
NAME    USER    TTYNAME    TIME    TIME   (SECS)  (SECS)  SIZE(K)

If a process was run by the root user, the process name is prefixed with a # (pound sign). If a process is not assigned to a known workstation ( for example, when the cron daemon runs the process), a ? (question mark) appears in the TTYNAME field.

Note:

The acctcom command only reports on processes that have finished. Use the ps command to examine active processes.
If a specified time is later than the current time, it is interpreted as occurring on the previous day.

Flags

Item	Description
-a	Shows some average statistics about the processes selected. The statistics are displayed after the output records.
-b	Reads backwards, showing the most recent commands first. This flag has no effect when the acctcom command reads standard input.
-c Classname	Selects processes belonging to the specified class. Note: Accounting data cannot be retrieved for a deleted class.
-C Seconds	Shows only processes whose total CPU time (system time + user time) exceeds the value specified by the Seconds variable.
-e Time	Selects processes existing at or before the specified time. You can use the current locale to specify the order of hours, minutes, and seconds. The default order is hh:mm:ss.
-E Time	Selects processes ending at or before the specified time. You can use the current locale to specify the order of hours, minutes, and seconds. The default order is hh:mm:ss. If you specify the same time for both the -E and -S flags, the acctcom command displays the processes that existed at the specified time.
-f	Displays two columns related to the `ac_flag` field of the acct.h file: the first indicates use of the fork command to create a process, the second indicates the system exit value.
-g Group	Selects processes belonging to the specified group. You can specify either the group ID or the group name.
-h	Instead of mean memory size, shows the fraction of total available CPU time consumed by the process (hog factor). This factor is computed as: `(total CPU time) / (elapsed time)`
-H Factor	Shows only the processes that exceed the value of the Factor parameter. This factor, called the hog factor, is computed as: `no(total CPU time) / (elapsed time)`
-i	Displays columns showing the number of characters transferred in read or write operations (the I/O counts).
-k	Instead of memory size, shows total kcore minutes (memory measurement in kilobyte segments used per minute of run time).
-l Line	(lowercase L) Shows only processes belonging to workstation /dev/Line.
-I Number	(uppercase i) Shows only processes transferring more than the specified number of characters.
-m	Shows mean main-memory size. This is the default. The -h flag or -k flag turn off the -m flag.
-n Pattern	Shows only commands matching the value of the Pattern variable, where Pattern is a regular expression. Regular expressions are described in the ed command. In addition to the usual characters, the acctcom command allows you to use a + (plus sign) as a special symbol for the preceding character.
-o File	Copies selected process records to the specified file, keeping the input data format. This flag suppresses writing to standard output. This flag cannot be used with the -q flag.
-O Seconds	Shows only processes with CPU system time exceeding the specified number of seconds.
-q	Displays statistics but not output records. The statistics are the same as those displayed using the -a flag. The -q flag cannot be used with the -o flag.
-r	Shows CPU factor. This factor is computed as: `(user-time) / (system-time + user-time)`
-s Time	Shows only those processes that existed on or after the specified time. You can use the current locale to specify the order of hours, minutes, and seconds. The default order is hh:mm:ss.
-S Time	Shows only those processes starting at or after the specified time. You can use the current locale to specify the order of hours, minutes, and seconds. The default order is hh:mm:ss.
-t	Shows separate system and user CPU times.
-u User	Shows only processes belonging to the specified user. Enter one of the following for the User variable: a user ID, a login name to be converted to a user ID, a `#` (pound sign) to select processes run by the root user, or a `?` (question mark) to select processes associated with unknown user IDs.
-v	Eliminates column headings from the output.
-w	Displays the class names to which the processes belong.
-W	Prints all available characters of each user name instead of truncating to the first 8 characters. The output is also widened to 132 characters allowing the user name to use the additional space. The -W option is mutually exclusive with the -X option. When both flags are used the second flag is ignored.
-X	Print all available characters of each user name instead of truncating to the first 8 characters. The user name is also moved to the last column of the output. The -X option is mutually exclusive with the -W option. When both flags are used the second flag is ignored.
-@ [ WparName ]	Displays summaries of process-accounting records for selected processes per workload partition. If a workload partition is specified using the WparName parameter, the accounting records for the specified workload partition are displayed. If no workload partition is specified, the accounting records for all of the workload partitions are displayed. A workload partition name is displayed for each record. The -@ option is not supported when executed within a workload partition.

Security

Attention RBAC users and Trusted AIX® users: This command can perform privileged operations. Only privileged users can run privileged operations. For more information about authorizations and privileges, see Privileged Command Database in Security. For a list of privileges and the authorizations associated with this command, see the lssecattr command or the getcmdattr subcommand.

Examples

To display information about processes that exceed 2 seconds of CPU time, enter:
```
/usr/sbin/acct/acctcom -O 2 < /var/adm/pacct
```
The process information is read from the /var/adm/pacct file.
To display information about processes belonging to the finance group, enter:
```
/usr/sbin/acct/acctcom -g Finance < /var/adm/pacct
```
The process information is read from the /var/adm/pacct file.
To display information about processes that belong to the /dev/console workstation and that run after 5 p.m., enter:
```
/usr/sbin/acct/acctcom -l /dev/console -s 17:00 
```
The process information is read from the /var/adm/pacct file by default.
To display all information about processes on a machine that has greater than 8 character user names, enter:
```
/usr/sbin/acct/acctcom -X < /var/adm/pacct
```
The process information is read from the /var/adm/pacct file.
To display information about processes that are run inside the warpath WPAR, use the following command:
```
acctcom -@ warpath < /var/adm/pacct
```
The process information is read from the /var/adm/pacct file.
To display information about processes that are run on all WPARs, use the following command:
```
acctcom -@ < /var/adm/pacct
```
The process information is read from the /var/adm/pacct file.

Files

Item	Description
/usr/sbin/acct/acctcom	Contains the acctcom command.
/var/adm/pacct	Contains the current process accounting file.
/etc/group	Contains the basic group attributes of groups.
/etc/passwd	Contains the basic attributes of users.