There's nothing wrong with a program that's using almost 100% of the CPU. It means the CPU is used very effective, and the OS isn't context switching the program away all the time.

Typically, as a system administrator, you want to monitor as much as possible. And what you are looking for are things that are unusual. For a particular program, you first have to get an indication of what you expect of the program, and what it's actually doing. For a program that does a lot of find and replace actions, you'd expect a lot of physical reads (unless most of the filesystem is already buffered), lots of logical reads, lots of logical writes, and depending on your filesystem and buffer size, physical writes.

90 to 95% CPU time could indicate many things. It could be that most of the files acted on are already buffered (hence little physical I/O, and no I/O waits). It could also mean that your program is written very inefficiently.

There's just too little information to say much about this situation.

As for tools, there's top, or its Solaris nephew prstat. You already mentioned it. You also mentioned truss, vmstat and ps. Good choices, and check out the manual page of truss, it has some useful options; counts of system calls can be very informative. HP has glance for HP-UX, which is, IMO, a wonderful tool. I think it has been ported to Solaris, but I'm not sure. However, if it is, it won't be free.

Abigail