csacom(1) csacom(1) NAME csacom - searches and prints the Comprehensive System Accounting (CSA) process accounting files SYNOPSIS csacom [-a] [-b] [-c] [-f] [-h] [-i] [-k] [-m] [-p] [-q] [-r] [-t] [-v] [-w] [-A] [-G] [-L] [-J] [-M] [-N] [-P] [-T] [-U] [-V] [-W] [-X] [-Z] [- e time] [-g group] [-j jid] [-l line] [-n pattern] [-o ofile] [-s time] [-u user] [-C sec] [-E time] [-H factor] [-I chars] [-O sec] [-S time] [files] DESCRIPTION The csacom utility reads data files, in the format defined in the acct.h file and writes selected records to standard output. You can specify files to be read; otherwise, the standard input, the file specified by the PACCT_FILE parameter in the /etc/csa.conf file, or the /var/adm/acct/day/pacct file is read. Each record represents the execution of one process. Memory and I/O fields are printed as zero if memory and I/O record accounting are turned off. The csacom utility accepts three types of options: output file options, selection options, and printing options. Output Options -o ofile Copies selected process records in the input data format to ofile, an output file you specify. Suppresses standard output printing. Selection Options -e time Selects processes existing at or before time, given in the format [Ddd:]hh[:mm[:ss]]. (See EXAMPLES.) The letter D flags the presence of the relative day offset parameter, which allows csacom to select records from a previous day. (To determine the day offset, use the -W option.) -g group Selects only processes belonging to group. You can designate the group by either the group ID or group name. -j jid Selects only processes that have a job ID that matches the jid argument. The jid argument is expected in hexadecimal. The "0x" prefix or the "0X" prefix are optional. -l line Selects only processes that belong to terminal /dev/line. -n pattern Selects only commands matching pattern that may be a regular expression, as in regcmp(3G). -s time Selects processes existing at or after time, given in the format [Ddd:]hh[:mm[:ss]]. See the -e option and EXAMPLES for more information on this format. Using the same time for both -s and -e shows the processes that existed at time. -u user Selects only processes that belong to user. May be specified by a user ID, a login name that is then converted to a user ID, a # symbol designating only those processes executed with superuser privileges, or a question mark (?) designating only those processes associated with an unknown user ID. To avoid interpretation by the shell, the question mark must be escaped. -C sec Selects only processes with total CPU time (system plus user time) exceeding sec seconds. -E time Selects processes ending at or before time, given in the format [Ddd:]hh[:mm[:ss]]. See the -e option and EXAMPLES for more information on this format. -H factor Selects only processes that exceed factor. Factor is the "hog factor" (as explained in the description of printing option -h). -I chars Selects only processes that transfer more characters than the cutoff number given by chars. Processes that do not have I/O information (I/O record accounting turned off) are not selected. -O sec Selects only processes with CPU system time exceeding sec seconds. -S time Selects processes that start at or after time, given in the format [Ddd:]hh[:mm[:ss]]. See the -e option for more information on this format. Printing Options -a Shows some average statistics about the processes selected. The statistics are printed after the output records. -b Reads backward, showing latest commands first. This option has no effect when the standard input is read. The -b and -W options are mutually exclusive. -c Prints the number of read and write system calls, separately. -f Prints the fork/exec flag followed by the exit status. Output is in octal. -h Prints the fraction of total available CPU time consumed by the process during its execution. This is known as the "hog factor" and is computed as follows: (total CPU time)/(elapsed time) -i Prints the number of characters read and written, and the number of blocks read and written. The read and written values are printed separately. -k Prints total kcore-minutes and kvirtual-minutes. These are the average memory sizes of the process if its execution time is normalized to one minute. -m Prints mean core size and mean virtual memory size. These are the average memory sizes of the process while executing. This is the default print option. If you do not specify any other print options, -m is selected. If you do specify other print options and you want mean memory sizes to print, you must specify -m. -p Prints process ID and parent process ID. -q Prints only the average statistics as with the -a option. Does not print any output records. -r Prints the CPU factor (user time/(system time + user time)). -t Prints separate system and user CPU times. -v Excludes column headings from the output. -w Prints the run queue, block I/O, and raw I/O wait times. -A Prints the array session handle. -G Prints the numeric group ID. -L Prints the accounting configuration records that report events, such as when accounting was started and stopped, and when accounting files were switched. If no other printing option is selected with -L, -m is assumed. -J Prints a column with job IDs. -M Prints the high-water core memory and virtual memory usage values. -N Prints the nice field value and scheduling discipline. The nice value is the scheduling priority for use of CPU time. The range of values typically is 0 through 39, with 0 being super user and higher nice values being lower priorities. Scheduling discipline is the scheduling mode of a shared group. -P Prints the project ID. -T Prints the start-of-job and end-of-job data. Ignores all other print options, except the -b, -v, and -L options. -U Shows all user IDs in numeric format. -V Combines the I/O and wait time values time. This option must be specified with the -c, -i or -w option. -W Prints the start and end dates and each date change found in the file. Ignores all other print and selection options, except the -L option. This option is useful if your data spans more than 1 day (that is, not 00:00 to 00:00) and if more than 1 day of data is present in the pacct file. The day number of the date change is printed and can be used with the time selects. (See Example 2.) Only timestamps of end-of-process records are used to determine if there is a date change. The -b and -W options are mutually exclusive. -X Prints the process start date. The date follows the last data printed on the line and will be in the format: day month date year (for example, Sat Feb 12 2000). -Y Prints the process end date. The date follows the last data printed on the line and will be in the format: day month date year (for example, Sat Feb 12 2000). -Z Skips (does not print) first seven fields (must be specified with one of the print options (-cfhikmprtwAGJMNPXY)). files Input file(s) you specify. These are one or more of the /var/adm/acct/day/pacct* files. If you do not specify files, and if the standard input is not associated with a terminal or /dev/null (as is the case when using & in the shell), the standard input is read. Otherwise, the file specified by the PACCT_FILE parameter in the /etc/csa.conf file is read. If that parameter does not exist, then /var/adm/acct/day/pacct is read. Therefore, when executing csacom using the Network Queuing System (NQS), you must specify files. Any file arguments specified are read in their respective order. Each file is usually read forward; that is, in chronological order by process completion time. The /var/adm/acct/day/pacct file is the current file to be examined. The output fields are as follows: -------------------------------------------------------------------- Field Name Option Definition -------------------------------------------------------------------- COMMAND NAME ! Z ASCII command name OR #command name if executed with super-user privileges USER ! Z ASCII user name ! Z Numeric user ID && -U TTYNAME ! Z ASCII tty name (? in this field indicates that a process is not associated with a known terminal) START TIME ! Z Start time of process in clock format (that is, 10:01:25) END TIME ! Z End time of process in clock format (that is, 10:10:15) REAL (SECS) ! Z Elapsed time of process in seconds CPU (SECS) ! Z && !-t CPU time used by the process in seconds OR SYSTEM (SECS) -t System time used by the process in seconds USER (SECS) -t User time used by the process in seconds CHARS READ -i Number of characters read CHARS WRITTEN -i Number of characters written CPU FACTOR -r User time divided by the CPU time HOG FACTOR -h CPU time divided by the elapsed time BLOCKS READ -i Number of blocks read BLOCKS WRITTEN -i Number of blocks written CHARS TRNSFD -iV Number of characters transferred BLOCKS TRNSFD -iV Number of blocks transferred MEAN CORE SIZE (KB) -m Average amount of core memory used by the process in kilobytes MEAN VIRT SIZE (KB) -m Average amount of virtual memory used by the process in kilobytes KCORE MIN (KB) -k Amount of core memory used by the process in kilobytes * minutes KVIRTUAL MIN (KB) -k Amount of virtual memory used by the process in kilobytes * minutes F STAT -f F is the fork/exec flag in octal. STAT is the exit condition in octal (value from exit() system call). Signal number: 0 means manual exit; 0200 means core dump. JOB ID -J Job identifier ARRAY SESSION HANDLE -A Array session identifier PROJECT ID -P Project identifier GROUP ID -G Group identifier LOGICAL READS -c Number of read system calls LOGICAL WRITES -c Number of write system calls LOGICAL REQS -cV Number of logical I/O requests RUN QUEU WAIT (S) -w Run queue wait time in seconds IOWAIT (SECS) BLOCK -w Block I/O wait time in seconds IOWAIT (SECS) RAW -w Raw I/O wait time in seconds IOWAIT (SECS) -wV I/O wait time in seconds PID -p Process identifier PPID -p Parent process identifier HIMEM (KBYTES) CORE -M High-water core memory usage value in kilobytes HIMEM (KBYTES) VIRTUAL -M High-water virtual memory usage value in kilobytes NICE -N Nice value of the process SCHED DISC -N Scheduling discipline of the share group TIME -T Time of the event in clock format (that is, 10:01:25) EVENT -T Event that caused the accounting record to be written CORE_HIMEM -T Job high-water core memory usage value in kilobytes VIRT_HIMEM -T Job high-water virtual memory usage value PROCESS START DATE -X Date that the process started in ctime format PROCESS END DATE -Y Date that the process ended in ctime format NOTES The csacom command does not print the daemon accounting records in the data files. The csacom command reports only on processes that have terminated; use the ps(1) command to view active processes. If time exceeds the present time, time is interpreted as occurring on the previous day. EXAMPLES Example 1: The following example generates a list of commands executed by user samuel by examining all current process accounting files. The output includes system and user CPU times. In this example, if the pacct files are not specified in the order shown, the commands may not be reported in ascending time order. csacom -u samuel -t /var/adm/acct/day/pacct?* /var/adm/acct/day/pacct Example 2: The following example shows how, using the printing option -W, the day number of the date change is printed. csacom -W Day 0: Mon Apr 3 10:20:11 2000 - first record. Day 1: Tue Apr 4 00:00:00 2000 - date change. Day 4: Fri Apr 7 10:20:00 2000 - date change. Day 4: Fri Apr 7 14:43:10 2000 - last record. Example 3: The following example shows how you would select and print data from day 4, 10:20 A.M. in Example 2; you would use the same format to specify dates and times when using selection options -e, -E, -s, -S. csacom -s D4:10:20 Example 4: The following example shows how you would select and print data from the pacct file for an interval on day 4 between 8:00 A.M. and 4:00 P.M. csacom -S D4:08:00:00 -E D4:16:00:00 FILES /etc/csa.conf Accounting configuration file /etc/passwd Password file that contains user names and user IDs /etc/group Group file that contains group names and group IDs /var/adm/acct/day/pacct Process accounting file that contains resource usage information for processes running on the system SEE ALSO csaaddc(1M), csacms(1M), csacon(1M), csarun(1M), csaswitch(1M), nice(1), ps(1), su(1), schedctl(2), acctctl(3c), regcmp(3G). Page 7