-
Notifications
You must be signed in to change notification settings - Fork 0
/
accounting.info
917 lines (698 loc) · 30.5 KB
/
accounting.info
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
This is accounting.info, produced by makeinfo version 4.13 from
accounting.texi.
INFO-DIR-SECTION GNU Utilities
START-INFO-DIR-ENTRY
* acct: (accounting). The GNU Accounting utilities for process and login accounting
END-INFO-DIR-ENTRY
INFO-DIR-SECTION Miscellaneous
START-INFO-DIR-ENTRY
* acct: (accounting). User specific process accounting.
END-INFO-DIR-ENTRY
GNU Accounting Utilities Copyright (C) 1993, 1996, 1997, 1998, 2005,
2008, 2009, 2010 Free Software Foundation, Inc.
Permission is granted to make and distribute verbatim copies of this
manual provided the copyright notice and this permission notice are
preserved on all copies.
Permission is granted to copy and distribute modified versions of
this manual under the conditions for verbatim copying, provided that the
entire resulting derived work is distributed under the terms of a
permission notice identical to this one.
Permission is granted to copy and distribute translations of this
manual into another language, under the above conditions for modified
versions, except that this permission notice may be stated in a
translation approved by the Foundation.
File: accounting.info, Node: Top, Next: Preface, Prev: (dir), Up: (dir)
Welcome to the GNU Accounting Utilities! If you don't have a clue
about the accounting utilities, read the introduction. For specfic
information about any of the applications, see the chapter with the
program's name.
This is version 6.6.4 of the GNU Accounting Utilities.
* Menu:
* Preface:: general information about the accounting utilities
* ac:: print statistics about connect time
* accton:: turns accounting on or off
* lastcomm:: list last commands executed
* sa:: print accounting statistics
* dump-acct:: print accounting file in human-readable form
File: accounting.info, Node: Preface, Next: ac, Prev: Top, Up: Top
Preface
*******
Way back a long time ago, Thompson and Ritchie were sitting opposite one
another at the commissary, sipping coffees and discussing their evolving
behemoth.
"This behemoth of ours," said Ken, "is becoming rather popular,
wouldn't you say?" "Yes," said Dennis. "Every time I want to do a
compilation, I have to wait for hours and hours. It's infuriating."
They both agreed that the load on their system was too great. Both
sighed, picked up their mugs, and went back to the workbench. Little
did they know that an upper-management type was sitting just within
earshot of their conversation.
"We are AT&T Bell Laboratories, aren't we?" the upper-management type
thought to himself. "Well, what is our organization best known for?"
The brill-cream in his hair glistened. "Screwing people out of lots of
money, of course! If there were some way that we could keep tabs on
users and charge them through the nose for their CPU time..."
The accounting utilities were born.
Seriously though, the accouting utilities can provide a system
administrator with useful information about system usage--connections,
programs executed, and utilization of system resources.
Information about users--their connect time, location, programs
executed, and the like--is automatically recored in files by `init' and
`login'. Four of them are of interest to us: `wtmp', which has records
for each login and logout; `acct', which records each command that was
run; `usracct' and `savacct', which contain summaries of the
information in `acct' by user and command, respectively. Each of the
accounting utilities reports or summarizes information stored in these
files.
`ac'
prints statistics about users' connect time. `ac' can tell you how
long a particular user or group of users were connected to your
system, printing totals by day or for all of the entries in the
`wtmp' file.
`accton'
turns accounting on or off.
`lastcomm'
lists the commands executed on the system, most recent first,
showing the run state of each command. With `last', you can
search the `acct' file for a particular user, terminal, or command.
`sa'
summarizes the information in the `acct' file into the `savacct'
and `usracct' file. It also generates reports about commands,
giving the number of invocations, cpu time used, average core
usage, etc.
`dump-acct'
`dump-utmp'
display `acct' and `utmp' files in a human-readable format.
For more detailed information on any of these programs, check the
chapter with the program title.
A Note on File Names and Locations
==================================
The `wtmp' and `acct' files seem to live in different places and have
different names for every variant of u*x that exists. The name `wtmp'
seems to be standard for the login accounting file, but the process
accounting file might be `acct' or `pacct' on your system. To find the
actual locations and names of these files on your system, specify the
`--help' flag to any of the programs in this package and the
information will dumped to standard output.
Regardless of the names and locations of files on your system, this
manual will refer to the login accounting file as `wtmp' and the
process accounting files as `acct', `savacct', and `usracct'.
Support for Multiple Accounting File Formats under Linux
========================================================
The detailed format of the `acct' file written by the Linux kernel
varies depending on the kernel's version and configuration: Linux
kernels 2.6.7 and earlier write a v0 format `acct' file which
unfortunately cannot store user and group ids (`uid'/`gid') larger than
65535. Kernels 2.6.8 and later write the `acct' file in v1, v2 or v3
formats. (v3 if `BSD_PROCESS_ACCT_V3' is selected in the kernel
configuration, otherwise v1 if on the m68k architecture or v2
everywhere else).
Since version 6.4 the GNU accounting utilities on Linux systems are
able to read all of the v0, v2 and v3 file formats (v1 is not
supported). Thus you do not need to worry about the details given
above. You can even read `acct' files where different records were
written by differently configured kernels (you can find out about the
format of each entry by using the `dump-acct' utility). In case you
ever need to convert an `acct' file to a different format, the `--raw'
option of `dump-acct' does that together with the new `--format' and
`--byteswap' options that determine format and byte order of the output
file.
Multiformat support under Linux is intended to be a temporary
solution to aid in switching to the v3 `acct' file format. So do not
expect GNU acct 6.7 to still contain Multiformat support. In a few years
time, when everybody uses the v3 format, the ability to read multiple
formats at runtime will probably be dropped again from the GNU
accounting utilities. This does not, however, affect the ability to
adapt to the `acct' file format at compile time (when `./configure' is
run). Even GNU acct 6.3.5 (that does not know about multiple file
formats) will yield working binary programs when compiled under a (as
yet hypothetical) Linux kernel 2.6.62 that is only able to write the v3
format.
History of the Accounting Utilities
===================================
I don't have any idea who originally wrote these utilities. If anybody
does, please send some mail to `[email protected]' and I'll add your
information here!
Since the first alpha versions of this software in late 1993, many
people have contributed to the package. They are (in alphabetical
order):
`Eric Backus <[email protected]>'
Suggested fixes for HP-UX 9.05 using /bin/cc: configure assumed
you were using `gcc' and tacked on `-Wall' etc. He also noticed
that `file_rd.c' was doing pointer arithmetic on a `void *' pointer
(non-ANSI).
`Christoph Badura <[email protected]>'
Christoph was a BIG HELP in computing statistics, most notably
k*sec stuff! He also did Xenix testing and contributed some
Makefile fixes and output optimizations.
`Michael Calwas <[email protected]>'
Fixed bugs in mktime.c.
`Derek Clegg <[email protected]>'
Suggested the simple, elegant fix for *_rd_never_used brain-damage.
`Alan Cox <[email protected]>'
Original Linux kernel accounting patches.
`Scott Crosby <[email protected]>'
Suggested idea behind `--sort-real-time' for `sa'.
`Solar Designer <[email protected]>'
Added code for `--ahz' flag in `lastcomm' and `sa'.
`Dirk Eddelbuettel <[email protected]>'
Managed bug-fixes & etc. for Debian distribution, as well as the
architect of merge of GNU + Debian distributions. A big thanks to
Dirk for kicking me back into gear again after a long period of no
work on this project.
`Jason Grant <[email protected]>'
Identified a buffer-overrun bug in `sa'.
`Kaveh R. Ghazi <[email protected]>'
Tested the package on many systems with compilers other than gcc.
Fixed K&R C support.
`Susan Kleinmann <[email protected]>'
Contributed excellent man pages!
`Alexander Kourakos <[email protected]>'
Inspired the `--wide' option for `last'.
`Marek Michalkiewicz <[email protected]>'
Suggested the `--ip-address' flag for `last'.
`David S. Miller <[email protected]>'
Noticed missing GNU-standard makefile rules.
`Walter Mueller <[email protected]>'
Noticed install target was missing, and corrected a typo for
prefix in Makefile.in.
`Ian Murdock <[email protected]>'
Tracked down miscellaneous bugs in sa.c under Linux. Added Debian
package maintenance files.
`Tuomo Pyhala <[email protected]>'
Reported buggy `--strict-match' flag in `lastcomm'.
`Tim Schmielau <[email protected]>'
Added Linux multiformat support.
`Luc I. Suryo <[email protected]>'
Suggested the `--user' flag for `lastcomm'.
`Pedro A M Vazquez <[email protected]>'
Fixed bugs in sa.c and tested under FreeBSD.
`Marco van Wieringen <[email protected]>'
Modified (wrote?) Linux kernel accounting patches.
File: accounting.info, Node: ac, Next: accton, Prev: Preface, Up: Top
1 `ac'
******
The `ac' command prints out a report of connect time (in hours) based
on the logins/logouts in the current `wtmp' file. A total is also
printed out.
The accounting file `wtmp' is maintained by `init' and `login'.
Neither of these programs creates the file; if the file is not there,
no accounting is done. To begin accounting, create the file with a
length of zero. Note that the `wtmp' file can get really big, really
fast. You might want to trim it every once and a while.
GNU `ac' works nearly the same u*x `ac', though it's a little
smarter in its printing out of daily totals--it actually prints _every_
day, rather than skipping to the date of the next entry in the `wtmp'
file.
1.1 Flags
=========
All of the original `ac''s options have been implemented, and a few have
been added. Normally, when `ac' is invoked, the output looks like this:
total 93867.14
where total is the number of hours of connect time for every entry in
the `wtmp' file. The rest of the flags modify the output in one way or
another.
`-d'
`--daily-totals'
Print totals for each day rather than just one big total at the
end. The output looks like this:
Jul 3 total 1.17
Jul 4 total 2.10
Jul 5 total 8.23
Jul 6 total 2.10
Jul 7 total 0.30
`-p'
`--individual-totals'
Print time totals for each user in addition to the usual
everything-lumped-into-one value. It looks like:
bob 8.06
goff 0.60
maley 7.37
root 0.12
total 16.15
`PEOPLE'
Print out the sum total of the connect time used by all of the
users included in people. Note that people is a space separated
list of valid user names; wildcards are not allowed.
`-f FILENAME'
`--file FILENAME'
Read from the file FILENAME instead of the system's `wtmp' file.
`--complain'
When the `wtmp' file has a problem (a time-warp, missing record,
or whatever), print out an appropriate error.
`--reboots'
Reboot records are _not_ written at the time of a reboot, but when
the system restarts; therefore, it is impossible to know EXACTLY
when the reboot occurred. Users may have been logged into the
system at the time of the reboot, and many `ac''s automatically
count the time between the login and the reboot record against the
user (even though all of that time _shouldn't_ be, perhaps, if the
system is down for a long time, for instance). If you want to
count this time, include the flag. *To make `ac' behave like the
one that was distributed with your OS, include this flag.*
`--supplants'
Sometimes a logout record is not written for a specific terminal,
so the time that the last user accrued cannot be calculated. If
you want to include the time from the user's login to the next
login on the terminal (though probably incorrect), include this
flag. *To make `ac' behave like the one that was distributed with
your OS, include this flag.*
`--timewarps'
Sometimes, entries in a `wtmp' file will suddenly jump back into
the past without a clock change record occurring. It is
impossible to know how long a user was logged in when this occurs.
If you want to count the time between the login and the time warp
against the user, include this flag. *To make `ac' behave like the
one that was distributed with your OS, include this flag.*
`--compatibility'
This is shorthand for typing out the three above options.
`-a'
`--all-days'
If we're printing daily totals, print a record for every day
instead of skipping intervening days where there is no login
activity. Without this flag, time accrued during those
intervening days gets listed under the next day where there is
login activity.
`-y'
`--print-year'
Print out the year when displaying dates.
`--print-zeros'
If a total for any category (save the grand total) is zero, print
it. The default is to suppress printing.
`--debug'
Print verbose internal information.
`--tw-leniency VALUE'
Set the time warp leniency value (in seconds). Records in `wtmp'
files might be slightly out of order (most notably when two logins
occur within a one-second period - the second one gets written
first). By default, this value is set to 1 second. Some `wtmp''s
are really screwed up (Suns) and require a larger value here. If
the program notices this problem, time is not assigned to users
unless the `--timewarps' flag is used. See the Problems section
for more information.
`--tw-suspicious VALUE'
Set the time warp suspicious value (in seconds). If two records
in the `wtmp' file are farther than this number of seconds apart,
there is a problem with the wtmp file (or your machine hasn't been
used in a year). If the program notices this problem, time is not
assigned to users unless the `--timewarps' flag is used.
`-V'
`--version'
Print `ac''s version number.
`-h'
`--help'
Print `ac''s usage string and default locations of system files to
standard output.
1.2 Problems
============
For no fault of `ac''s, if two logins occur at the same time (within a
second of each other), each `login' process will try to write an entry
to the `wtmp' file. With file system overhead, it is forseeable that
the entries would get written in the wrong order. GNU `ac'
automatically compensates for this, but some other `ac's may not...
beware.
The FTP Problem
---------------
I've tested the standard `ac' in Ultrix 4.2 (DECstation/DECsystem),
SunOS 4.1.1 (Sun3, Sun4, Sparc), Mach 2.5 (Omron/Luna), and DomainOS
10.3 (DN3500). All of these `ac's have trouble parsing entries in
which the line is `ftp'XXXX (XXXX being some number). Whenever these
`ac's see one of these entries, they log everyone out at the time of
the entry.
*HOW IT HAPPENS:* if there is a user logged into the machine when an
ftp connection occurs, (minimally) you'll get a login record for the
user, a login record for the ftp connection, and the logouts for both
afterwards (in either order).
*TANGIBLE RESULT:* the user who was logged in gets 'logged out' at the
time the ftp connection begins, and none of the time spent during or
after the ftp connection. Therefore, when you run GNU `ac', the totals
will most likely be greater than those of your system's `ac' (provided
you specify the other flags that will make GNU `ac' behave like the
system's).
The Shutdown/Reboot Problem
...........................
On Suns, `init' is a little screwed up. For some reason, after a
shutdown record is written, a reboot record is written with a time-stamp
_before_ the shutdown (less than 30 seconds, usually).
*TANGIBLE RESULT:* GNU `ac' will notice the problem, log everyone out
(you can specify if you want the time to be added to the user's total)
and begin a new day entry based on the time of the out-of-sync record.
If you try to print out daily totals, you'll notice that some days
might have two or more entries.
*SOLUTION:* To fix this, a timewarp leniency value has been
implemented. If any record is out of order by this number of seconds
(defaults to 60) it gets ignored. If you need to change this value (if
you think the totals are off because the value is too high), you can
change it using the `--timewarp-value' flag. The rationale for the 60
second default is that of all of the machines with this problem, the
largest timewarp was 45.
Stupid System V Machines
........................
Some `ac''s on System V machines (I've tried SGI Indigo & SGI Indy)
forget to pay attention to the `ut_type' field in a `struct utmp'. As
such, they chalk up a lot of time to non-existant processes called
`LOGIN' or `runlevel'.
*TANGIBLE RESULT:* The amount of total time reported by the system's
`ac' is *really* off. Often, it's several times greater than what it
should be.
*SOLUTION:* GNU `ac' always pays attention to the `ut_type' record, so
there's no possibility of chalking up time to anything but user
processes.
File: accounting.info, Node: accton, Next: lastcomm, Prev: ac, Up: Top
2 `accton'
**********
`accton' turns process accounting on or off. To save process
accounting information in ACCOUNTINGFILE, use:
`accton ACCOUNTINGFILE'
2.1 Flags
=========
`-V'
`--version'
Print `accton''s version number.
`-h'
`--help'
Print `accton''s usage string and default locations of system files
to standard output.
`on'
Turns on process accounting using the default accounting file.
`off'
Turns off process accounting.
File: accounting.info, Node: lastcomm, Next: sa, Prev: accton, Up: Top
3 `lastcomm'
************
`lastcomm' prints out information about previously executed commands.
If no arguments are specified, `lastcomm' will print info about all of
the commands in the `acct' file (the record file). If called with a
command name, user name, or tty name, only records containing those
items will be displayed. For example, to find out which users used
command `a.out' and which users were logged into `tty0', type:
`lastcomm a.out tty0'
This will print any entry for which `a.out' or `tty0' matches in any
of the record's fields (command, name, or tty). If you want to find
only items that match ALL of the arguments on the command line, you
must use the '-strict-match' option. For example, to list all of the
executions of command `a.out' by user `root' on terminal `tty0', type:
`lastcomm --strict-match a.out root tty0'
The order of the arguments is not important.
For each entry the following information is printed:
* command name of the process
* flags, as recorded by the system accounting routines:
- *S* command executed by super-user
- *F* command executed after a fork but without a following exec
- *C* command run in PDP-11 compatibility mode (VAX only)
- *D* command terminated with the generation of a core file
- *X* command was terminated with the signal SIGTERM
* the name of the user who ran the process
* time the process exited
3.1 Flags
=========
This program implements the features of regular u*x `lastcomm' with a
few extra flags. When `lastcomm' is invoked without arguments, the
output looks like this:
nslookup jberman ttypb 0.03 secs Tue Feb 16 19:23
comsat root __ 0.03 secs Tue Feb 16 19:19
uptime ctilburg __ 0.11 secs Tue Feb 16 19:23
sh F ctilburg __ 0.02 secs Tue Feb 16 19:23
sleep ctilburg __ 0.02 secs Tue Feb 16 19:22
ls noel ttyp4 0.19 secs Tue Feb 16 19:23
`--strict-match'
Print only entries that match _all_ of the arguments on the command
line.
`--user NAME'
List records for user with NAME. This is useful if you're trying
to match a username that happens to be the same as a command (e.g.,
`ed').
`--command NAME'
List records for command NAME.
`--tty NAME'
List records for tty NAME.
`-f FILENAME'
`--file FILENAME'
Read from the file FILENAME instead of the system's `acct' file.
`--ahz HZ'
Use this flag to tell the program what `AHZ' should be (in hertz).
This option is useful if you are trying to view an `acct' file
created on another machine which has the same byte order and file
format as your current machine, but has a different value for
`AHZ'.
`-p'
`--show-paging'
Print paging statistics
`--debug'
Print verbose internal information.
`--version'
Print `lastcomm''s version number.
`--help'
Print `lastcomm''s usage string and default locations of system
files to standard output.
File: accounting.info, Node: sa, Next: dump-acct, Prev: lastcomm, Up: Top
4 `sa'
******
`sa' summarizes information about previously executed commands as
recorded in the `acct' file. In addition, it condenses this data into
the `savacct' summary file, which contains the number of times the
command was called and the system resources used. The information can
also be summarized on a per-user basis; `sa' will save this information
into `usracct'. Usage:
`sa [OPTS] [FILE]'
If no arguments are specified, `sa' will print information about all
of the commands in the `acct' file. If command names have unprintable
characters, or are only called once, `sa' will sort them into a group
called `***other'. Overall totals for each field are gathered and
printed with a blank command name.
If called with a file name as the last argument, `sa' will use that
file instead of `acct'.
By default, `sa' will sort the output by sum of user and system time.
The output fields are labeled as follows:
`cpu'
sum of system and user time in cpu seconds
`re'
"real time" in cpu seconds
`k'
cpu-time averaged core usage, in 1k units
`avio'
average number of I/O operations per execution
`tio'
total number of I/O operations
`k*sec'
cpu storage integral (kilo-core seconds)
`u'
user cpu time in cpu seconds
`s'
system time in cpu seconds
Note that these column titles do not appear in the first row of the
table, but after each numeric entry (as units of measurement) in every
row. For example, you might see `79.29re', meaning 79.29 cpu seconds
of "real time."
An asterisk will appear after the name of commands that forked but
didn't call `exec'.
4.1 Flags
=========
The availability of these program options depends on your operating
system. In specific, the members that appear in the `struct acct' of
your system's process accounting header file (usually `acct.h')
determine which flags will be present. For example, if your system's
`struct acct' doesn't have the `ac_mem' field, the installed version of
`sa' will not support the `--sort-cpu-avmem', `--sort-ksec', `-k', or
`-K' options.
In short, all of these flags may not be available on your machine.
`-a'
`--list-all-names'
Force `sa' not to sort those command names with unprintable
characters and those used only once into the ``***other'' group.
`-b'
`--sort-sys-user-div-calls'
Sort the output by the sum of user and system time divided by the
number of calls.
`-c'
`--percentages'
Print percentages of total time for the command's user, system,
and real time values.
`-d'
`--sort-avio'
Sort the output by the average number of disk I/O operations.
`-D'
`--sort-tio'
Print and sort the output by the total number of disk I/O
operations.
`-f'
`--not-interactive'
When using the `--threshold' option, assume that all answers to
interactive queries will be affirmative.
`-i'
`--dont-read-summary-file'
Don't read the information in `savacct'.
`-j'
`--print-seconds'
Instead of printing total minutes for each category, print seconds
per call.
`-k'
`--sort-cpu-avmem'
Sort the output by cpu time average memory usage.
`-K'
`--sort-ksec'
Print and sort the output by the cpu-storage integral.
`-l'
`--separate-times'
Print separate columns for system and user time; usually the two
are added together and listed as `cpu'.
`-m'
`--user-summary'
Print the number of processes and number of CPU minutes on a
per-user basis.
`-n'
`--sort-num-calls'
Sort the output by the number of calls. This is the default
sorting method.
`-p'
`--show-paging'
Print the number of minor and major pagefaults and swaps.
`-P'
`--show-paging-avg'
Print the number of minor and major pagefaults and swaps divided by
the number of calls.
`-r'
`--reverse-sort'
Sort output items in reverse order.
`-s'
`--merge'
Merge the summarized accounting data into the summary files
`savacct' and `usracct'.
`-t'
`--print-ratio'
For each entry, print the ratio of real time to the sum of system
and user times. If the sum of system and user times is too small
to report--the sum is zero--`*ignore*' will appear in this field.
`-u'
`--print-users'
For each command in the accounting file, print the userid and
command name. After printing all entries, quit. *Note*: this flag
supersedes all others.
`-v NUM'
`--threshold NUM'
Print commands which were executed NUM times or fewer and await a
reply from the terminal. If the response begins with `y', add the
command to the `**junk**' group.
`--separate-forks'
It really doesn't make any sense to me that the stock version of
`sa' separates statistics for a particular executable depending on
whether or not that command forked. Therefore, GNU `sa' lumps this
information together unless this option is specified.
`--sort-real-time'
Sort the output by the "real time" (elapsed time) for each command.
`--ahz HZ'
Use this flag to tell the program what `AHZ' should be (in hertz).
This option is useful if you are trying to view an `acct' file
created on another machine which has the same byte order and file
format as your current machine, but has a different value for
`AHZ'.
`--debug'
Print verbose internal information.
`-V'
`--version'
Print `sa''s version number.
`-h'
`--help'
Print `sa''s usage string and default locations of system files to
standard output.
*Note*: if more than one sorting option is specified, the list will
be sorted by the one specified last on the command line.
4.2 Problems
============
I haven't been able to test this on many different machines because the
data files grow so big in a short time; our sysadmin would rather save
the disk space.
Most versions of `sa' that I've tested don't pay attention to flags
like `--print-seconds' and `--sort-num-calls' when printing out
commands when combined with the `--user-summary' or `--print-users'
flags. GNU `sa' pays attention to these flags if they are applicable.
4.2.1 mips sa
-------------
The average memory use is stored as a short rather than a double, so we
suffer from round-off errors. GNU `sa' uses double the whole way
through.
File: accounting.info, Node: dump-acct, Prev: sa, Up: Top
5 `dump-acct'
*************
`dump-acct' dumps some of the contents of one or more `acct' files in
human readable form. Usage:
`dump-acct [OPTS] FILES'
Unless called with the `--raw' option, it prints a table with the
following fields, separated by vertical bars(`|'):
`ac_comm'
name of the executed program
`ac_version'
version of the `acct' file format
`ac_utime'
user time
`ac_stime'
system time
`ac_etime'
elapsed time
`ac_uid'
user id
`ac_gid'
group id
`ac_mem'
(average) memory usage
`ac_io'
number of characters transferred on input/output
`ac_pid'
process id
`ac_ppid'
parent's process id
All times will be given in platform dependent units ("`AHZ'"). Not
all of the above columns will actually appear, depending on what
information your operating system provides in it's `struct acct'.
5.1 Flags
=========
`--ahz HZ'
Use this flag to tell the program what `AHZ' should be (in Hertz).
This option is useful if you are trying to view an `acct' file
created on another machine which has a different value for `AHZ'.
`--byteswap'
Swap the bytes (relative to your system's native byte order) in
`--raw' output.
`--format'
Set output format with `--raw' option.
`-n NUM'
`--num NUM'
Limit the number of lines (or records with `--raw') to print.
`-r'
`--reverse'
Read the accounting file backwards (print latest record first).
`-R'
`--raw'
Don't print human readable output, dump the raw record instead.
Useful to convert between different Linux file formats (see below).
`-h'
`--help'
Print `dump-acct''s usage string and default location of the
accouning file to standard output.
`--byteswap' and `--format' options are only available with Linux
multiformat support. They only affect _output_ with the `--raw' option,
format and byte order of the input are automatically detected. Thus
they are useful to convert between different file formats.
The `--ahz' option affects input and output (except for v3 file
format, which by definition is fixed to `AHZ=100'). If you ever need
to convert between different `AHZ' values, use a two-step process:
First convert to v3 format with the _old_ `AHZ' value, then convert to
the desired output format with the _new_ `AHZ' setting.
Tag Table:
Node: Top1174
Node: Preface1953
Node: ac10292
Node: accton18606
Node: lastcomm19152
Node: sa22326
Node: dump-acct28703
End Tag Table