{ "content": [ { "type": "text", "text": "# acct (info)\n\n## Sections\n\n- **Preface** (3 subsections)\n- **1 'ac'** (2 subsections)\n- **2 'accton'** (1 subsections)\n- **3 'lastcomm'** (1 subsections)\n- **4 'sa'** (2 subsections)\n- **5 'dump-acct'** (1 subsections)\n\nUse structuredContent.sections for detailed options, examples, and full documentation.\n" } ], "structuredContent": { "command": "acct", "section": "", "mode": "info", "summary": null, "synopsis": null, "tldr_summary": null, "tldr_examples": [], "tldr_source": null, "flags": [], "examples": [], "see_also": [], "section_outline": [ { "name": "Preface", "lines": 59, "subsections": [ { "name": "A Note on File Names and Locations", "lines": 12 }, { "name": "Support for Multiple Accounting File Formats under Linux", "lines": 32 }, { "name": "History of the Accounting Utilities", "lines": 84 } ] }, { "name": "1 'ac'", "lines": 14, "subsections": [ { "name": "1.1 Flags", "lines": 114 }, { "name": "1.2 Problems", "lines": 66 } ] }, { "name": "2 'accton'", "lines": 5, "subsections": [ { "name": "2.1 Flags", "lines": 17 } ] }, { "name": "3 'lastcomm'", "lines": 31, "subsections": [ { "name": "3.1 Flags", "lines": 52 } ] }, { "name": "4 'sa'", "lines": 54, "subsections": [ { "name": "4.1 Flags", "lines": 138 }, { "name": "4.2 Problems", "lines": 16 } ] }, { "name": "5 'dump-acct'", "lines": 45, "subsections": [ { "name": "5.1 Flags", "lines": 42 } ] } ], "sections": { "Preface": { "content": "Way back a long time ago, Thompson and Ritchie were sitting opposite one\nanother at the commissary, sipping coffees and discussing their evolving\nbehemoth.\n\n\"This behemoth of ours,\" said Ken, \"is becoming rather popular,\nwouldn't you say?\" \"Yes,\" said Dennis. \"Every time I want to do a\ncompilation, I have to wait for hours and hours. It's infuriating.\"\nThey both agreed that the load on their system was too great. Both\nsighed, picked up their mugs, and went back to the workbench. Little\ndid they know that an upper-management type was sitting just within\nearshot of their conversation.\n\n\"We are AT&T Bell Laboratories, aren't we?\" the upper-management\ntype thought to himself. \"Well, what is our organization best known\nfor?\" The brill-cream in his hair glistened. \"Screwing people out of\nlots of money, of course! If there were some way that we could keep\ntabs on users and charge them through the nose for their CPU time...\"\n\nThe accounting utilities were born.\n\nSeriously though, the accouting utilities can provide a system\nadministrator with useful information about system usage--connections,\nprograms executed, and utilization of system resources.\n\nInformation about users--their connect time, location, programs\nexecuted, and the like--is automatically recored in files by 'init' and\n'login'. Four of them are of interest to us: 'wtmp', which has records\nfor each login and logout; 'acct', which records each command that was\nrun; 'usracct' and 'savacct', which contain summaries of the information\nin 'acct' by user and command, respectively. Each of the accounting\nutilities reports or summarizes information stored in these files.\n\n'ac'\nprints statistics about users' connect time. 'ac' can tell you how\nlong a particular user or group of users were connected to your\nsystem, printing totals by day or for all of the entries in the\n'wtmp' file.\n\n'accton'\nturns accounting on or off.\n\n'lastcomm'\nlists the commands executed on the system, most recent first,\nshowing the run state of each command. With 'last', you can search\nthe 'acct' file for a particular user, terminal, or command.\n\n'sa'\nsummarizes the information in the 'acct' file into the 'savacct'\nand 'usracct' file. It also generates reports about commands,\ngiving the number of invocations, cpu time used, average core\nusage, etc.\n\n'dump-acct'\n'dump-utmp'\ndisplay 'acct' and 'utmp' files in a human-readable format.\n\nFor more detailed information on any of these programs, check the\nchapter with the program title.\n", "subsections": [ { "name": "A Note on File Names and Locations", "content": "The 'wtmp' and 'acct' files seem to live in different places and have\ndifferent names for every variant of u*x that exists. The name 'wtmp'\nseems to be standard for the login accounting file, but the process\naccounting file might be 'acct' or 'pacct' on your system. To find the\nactual locations and names of these files on your system, specify the\n'--help' flag to any of the programs in this package and the information\nwill dumped to standard output.\n\nRegardless of the names and locations of files on your system, this\nmanual will refer to the login accounting file as 'wtmp' and the process\naccounting files as 'acct', 'savacct', and 'usracct'.\n" }, { "name": "Support for Multiple Accounting File Formats under Linux", "content": "The detailed format of the 'acct' file written by the Linux kernel\nvaries depending on the kernel's version and configuration: Linux\nkernels 2.6.7 and earlier write a v0 format 'acct' file which\nunfortunately cannot store user and group ids ('uid'/'gid') larger than\n65535. Kernels 2.6.8 and later write the 'acct' file in v1, v2 or v3\nformats. (v3 if 'BSDPROCESSACCTV3' is selected in the kernel\nconfiguration, otherwise v1 if on the m68k architecture or v2 everywhere\nelse).\n\nSince version 6.4 the GNU accounting utilities on Linux systems are\nable to read all of the v0, v2 and v3 file formats (v1 is not\nsupported). Thus you do not need to worry about the details given\nabove. You can even read 'acct' files where different records were\nwritten by differently configured kernels (you can find out about the\nformat of each entry by using the 'dump-acct' utility). In case you\never need to convert an 'acct' file to a different format, the '--raw'\noption of 'dump-acct' does that together with the new '--format' and\n'--byteswap' options that determine format and byte order of the output\nfile.\n\nMultiformat support under Linux is intended to be a temporary\nsolution to aid in switching to the v3 'acct' file format. So do not\nexpect GNU acct 6.7 to still contain Multiformat support. In a few\nyears time, when everybody uses the v3 format, the ability to read\nmultiple formats at runtime will probably be dropped again from the GNU\naccounting utilities. This does not, however, affect the ability to\nadapt to the 'acct' file format at compile time (when './configure' is\nrun). Even GNU acct 6.3.5 (that does not know about multiple file\nformats) will yield working binary programs when compiled under a (as\nyet hypothetical) Linux kernel 2.6.62 that is only able to write the v3\nformat.\n" }, { "name": "History of the Accounting Utilities", "content": "I don't have any idea who originally wrote these utilities. If anybody\ndoes, please send some mail to 'noel@gnu.ai.mit.edu' and I'll add your\ninformation here!\n\nSince the first alpha versions of this software in late 1993, many\npeople have contributed to the package. They are (in alphabetical\norder):\n\n'Eric Backus '\nSuggested fixes for HP-UX 9.05 using /bin/cc: configure assumed you\nwere using 'gcc' and tacked on '-Wall' etc. He also noticed that\n'filerd.c' was doing pointer arithmetic on a 'void *' pointer\n(non-ANSI).\n\n'Christoph Badura '\nChristoph was a BIG HELP in computing statistics, most notably\nk*sec stuff! He also did Xenix testing and contributed some\nMakefile fixes and output optimizations.\n\n'Michael Calwas '\nFixed bugs in mktime.c.\n\n'Derek Clegg '\nSuggested the simple, elegant fix for *rdneverused brain-damage.\n\n'Alan Cox '\nOriginal Linux kernel accounting patches.\n\n'Scott Crosby '\nSuggested idea behind '--sort-real-time' for 'sa'.\n\n'Solar Designer '\nAdded code for '--ahz' flag in 'lastcomm' and 'sa'.\n\n'Dirk Eddelbuettel '\nManaged bug-fixes & etc. for Debian distribution, as well as the\narchitect of merge of GNU + Debian distributions. A big thanks to\nDirk for kicking me back into gear again after a long period of no\nwork on this project.\n\n'Jason Grant '\nIdentified a buffer-overrun bug in 'sa'.\n\n'Kaveh R. Ghazi '\nTested the package on many systems with compilers other than gcc.\nFixed K&R C support.\n\n'Susan Kleinmann '\nContributed excellent man pages!\n\n'Alexander Kourakos '\nInspired the '--wide' option for 'last'.\n\n'Marek Michalkiewicz '\nSuggested the '--ip-address' flag for 'last'.\n\n'David S. Miller '\nNoticed missing GNU-standard makefile rules.\n\n'Walter Mueller '\nNoticed install target was missing, and corrected a typo for prefix\nin Makefile.in.\n\n'Ian Murdock '\nTracked down miscellaneous bugs in sa.c under Linux. Added Debian\npackage maintenance files.\n\n'Tuomo Pyhala '\nReported buggy '--strict-match' flag in 'lastcomm'.\n\n'Tim Schmielau '\nAdded Linux multiformat support.\n\n'Luc I. Suryo '\nSuggested the '--user' flag for 'lastcomm'.\n\n'Pedro A M Vazquez '\nFixed bugs in sa.c and tested under FreeBSD.\n\n'Marco van Wieringen '\nModified (wrote?) Linux kernel accounting patches.\n\nFile: accounting.info, Node: ac, Next: accton, Prev: Preface, Up: Top\n" } ] }, "1 'ac'": { "content": "The 'ac' command prints out a report of connect time (in hours) based on\nthe logins/logouts in the current 'wtmp' file. A total is also printed\nout.\n\nThe accounting file 'wtmp' is maintained by 'init' and 'login'.\nNeither of these programs creates the file; if the file is not there, no\naccounting is done. To begin accounting, create the file with a length\nof zero. Note that the 'wtmp' file can get really big, really fast.\nYou might want to trim it every once and a while.\n\nGNU 'ac' works nearly the same u*x 'ac', though it's a little smarter\nin its printing out of daily totals--it actually prints every day,\nrather than skipping to the date of the next entry in the 'wtmp' file.\n", "subsections": [ { "name": "1.1 Flags", "content": "All of the original 'ac''s options have been implemented, and a few have\nbeen added. Normally, when 'ac' is invoked, the output looks like this:\ntotal 93867.14\nwhere total is the number of hours of connect time for every entry in\nthe 'wtmp' file. The rest of the flags modify the output in one way or\nanother.\n\n'-d'\n'--daily-totals'\nPrint totals for each day rather than just one big total at the\nend. The output looks like this:\nJul 3 total 1.17\nJul 4 total 2.10\nJul 5 total 8.23\nJul 6 total 2.10\nJul 7 total 0.30\n\n'-p'\n'--individual-totals'\nPrint time totals for each user in addition to the usual\neverything-lumped-into-one value. It looks like:\nbob 8.06\ngoff 0.60\nmaley 7.37\nroot 0.12\ntotal 16.15\n\n'PEOPLE'\nPrint out the sum total of the connect time used by all of the\nusers included in people. Note that people is a space separated\nlist of valid user names; wildcards are not allowed.\n\n'-f FILENAME'\n'--file FILENAME'\nRead from the file FILENAME instead of the system's 'wtmp' file.\n\n'--complain'\nWhen the 'wtmp' file has a problem (a time-warp, missing record, or\nwhatever), print out an appropriate error.\n\n'--reboots'\nReboot records are not written at the time of a reboot, but when\nthe system restarts; therefore, it is impossible to know EXACTLY\nwhen the reboot occurred. Users may have been logged into the\nsystem at the time of the reboot, and many 'ac''s automatically\ncount the time between the login and the reboot record against the\nuser (even though all of that time shouldn't be, perhaps, if the\nsystem is down for a long time, for instance). If you want to\ncount this time, include the flag. *To make 'ac' behave like the\none that was distributed with your OS, include this flag.*\n\n'--supplants'\nSometimes a logout record is not written for a specific terminal,\nso the time that the last user accrued cannot be calculated. If\nyou want to include the time from the user's login to the next\nlogin on the terminal (though probably incorrect), include this\nflag. *To make 'ac' behave like the one that was distributed with\nyour OS, include this flag.*\n\n'--timewarps'\nSometimes, entries in a 'wtmp' file will suddenly jump back into\nthe past without a clock change record occurring. It is impossible\nto know how long a user was logged in when this occurs. If you\nwant to count the time between the login and the time warp against\nthe user, include this flag. *To make 'ac' behave like the one\nthat was distributed with your OS, include this flag.*\n\n'--compatibility'\nThis is shorthand for typing out the three above options.\n\n'-a'\n'--all-days'\nIf we're printing daily totals, print a record for every day\ninstead of skipping intervening days where there is no login\nactivity. Without this flag, time accrued during those intervening\ndays gets listed under the next day where there is login activity.\n\n'-y'\n'--print-year'\nPrint out the year when displaying dates.\n\n'--print-zeros'\nIf a total for any category (save the grand total) is zero, print\nit. The default is to suppress printing.\n\n'--debug'\nPrint verbose internal information.\n\n'--tw-leniency VALUE'\nSet the time warp leniency value (in seconds). Records in 'wtmp'\nfiles might be slightly out of order (most notably when two logins\noccur within a one-second period - the second one gets written\nfirst). By default, this value is set to 1 second. Some 'wtmp''s\nare really screwed up (Suns) and require a larger value here. If\nthe program notices this problem, time is not assigned to users\nunless the '--timewarps' flag is used. See the Problems section\nfor more information.\n\n'--tw-suspicious VALUE'\nSet the time warp suspicious value (in seconds). If two records in\nthe 'wtmp' file are farther than this number of seconds apart,\nthere is a problem with the wtmp file (or your machine hasn't been\nused in a year). If the program notices this problem, time is not\nassigned to users unless the '--timewarps' flag is used.\n\n'-V'\n'--version'\nPrint 'ac''s version number.\n\n'-h'\n'--help'\nPrint 'ac''s usage string and default locations of system files to\nstandard output.\n" }, { "name": "1.2 Problems", "content": "For no fault of 'ac''s, if two logins occur at the same time (within a\nsecond of each other), each 'login' process will try to write an entry\nto the 'wtmp' file. With file system overhead, it is forseeable that\nthe entries would get written in the wrong order. GNU 'ac'\nautomatically compensates for this, but some other 'ac's may not...\nbeware.\n\n\nI've tested the standard 'ac' in Ultrix 4.2 (DECstation/DECsystem),\nSunOS 4.1.1 (Sun3, Sun4, Sparc), Mach 2.5 (Omron/Luna), and DomainOS\n10.3 (DN3500). All of these 'ac's have trouble parsing entries in which\nthe line is 'ftp'XXXX (XXXX being some number). Whenever these 'ac's\nsee one of these entries, they log everyone out at the time of the\nentry.\n\n*HOW IT HAPPENS:* if there is a user logged into the machine when an ftp\nconnection occurs, (minimally) you'll get a login record for the user, a\nlogin record for the ftp connection, and the logouts for both afterwards\n(in either order).\n\n*TANGIBLE RESULT:* the user who was logged in gets 'logged out' at the\ntime the ftp connection begins, and none of the time spent during or\nafter the ftp connection. Therefore, when you run GNU 'ac', the totals\nwill most likely be greater than those of your system's 'ac' (provided\nyou specify the other flags that will make GNU 'ac' behave like the\nsystem's).\n\nThe Shutdown/Reboot Problem\n...........................\n\nOn Suns, 'init' is a little screwed up. For some reason, after a\nshutdown record is written, a reboot record is written with a time-stamp\nbefore the shutdown (less than 30 seconds, usually).\n\n*TANGIBLE RESULT:* GNU 'ac' will notice the problem, log everyone out\n(you can specify if you want the time to be added to the user's total)\nand begin a new day entry based on the time of the out-of-sync record.\nIf you try to print out daily totals, you'll notice that some days might\nhave two or more entries.\n\n*SOLUTION:* To fix this, a timewarp leniency value has been implemented.\nIf any record is out of order by this number of seconds (defaults to 60)\nit gets ignored. If you need to change this value (if you think the\ntotals are off because the value is too high), you can change it using\nthe '--timewarp-value' flag. The rationale for the 60 second default is\nthat of all of the machines with this problem, the largest timewarp was\n45.\n\nStupid System V Machines\n........................\n\nSome 'ac''s on System V machines (I've tried SGI Indigo & SGI Indy)\nforget to pay attention to the 'uttype' field in a 'struct utmp'. As\nsuch, they chalk up a lot of time to non-existant processes called\n'LOGIN' or 'runlevel'.\n\n*TANGIBLE RESULT:* The amount of total time reported by the system's\n'ac' is *really* off. Often, it's several times greater than what it\nshould be.\n\n*SOLUTION:* GNU 'ac' always pays attention to the 'uttype' record, so\nthere's no possibility of chalking up time to anything but user\nprocesses.\n\nFile: accounting.info, Node: accton, Next: lastcomm, Prev: ac, Up: Top\n" } ] }, "2 'accton'": { "content": "'accton' turns process accounting on or off. To save process accounting\ninformation in ACCOUNTINGFILE, use:\n\n'accton ACCOUNTINGFILE'\n", "subsections": [ { "name": "2.1 Flags", "content": "'-V'\n'--version'\nPrint 'accton''s version number.\n\n'-h'\n'--help'\nPrint 'accton''s usage string and default locations of system files\nto standard output.\n\n'on'\nTurns on process accounting using the default accounting file.\n\n'off'\nTurns off process accounting.\n\nFile: accounting.info, Node: lastcomm, Next: sa, Prev: accton, Up: Top\n" } ] }, "3 'lastcomm'": { "content": "'lastcomm' prints out information about previously executed commands.\nIf no arguments are specified, 'lastcomm' will print info about all of\nthe commands in the 'acct' file (the record file). If called with a\ncommand name, user name, or tty name, only records containing those\nitems will be displayed. For example, to find out which users used\ncommand 'a.out' and which users were logged into 'tty0', type:\n\n'lastcomm a.out tty0'\n\nThis will print any entry for which 'a.out' or 'tty0' matches in any\nof the record's fields (command, name, or tty). If you want to find\nonly items that match ALL of the arguments on the command line, you must\nuse the '-strict-match' option. For example, to list all of the\nexecutions of command 'a.out' by user 'root' on terminal 'tty0', type:\n\n'lastcomm --strict-match a.out root tty0'\n\nThe order of the arguments is not important.\n\nFor each entry the following information is printed:\n\n* command name of the process\n* flags, as recorded by the system accounting routines:\n- *S* command executed by super-user\n- *F* command executed after a fork but without a following exec\n- *C* command run in PDP-11 compatibility mode (VAX only)\n- *D* command terminated with the generation of a core file\n- *X* command was terminated with the signal SIGTERM\n* the name of the user who ran the process\n* time the process started\n", "subsections": [ { "name": "3.1 Flags", "content": "This program implements the features of regular u*x 'lastcomm' with a\nfew extra flags. When 'lastcomm' is invoked without arguments, the\noutput looks like this:\nnslookup jberman ttypb 0.03 secs Tue Feb 16 19:23\ncomsat root 0.03 secs Tue Feb 16 19:19\nuptime ctilburg 0.11 secs Tue Feb 16 19:23\nsh F ctilburg 0.02 secs Tue Feb 16 19:23\nsleep ctilburg 0.02 secs Tue Feb 16 19:22\nls noel ttyp4 0.19 secs Tue Feb 16 19:23\n\n'--strict-match'\nPrint only entries that match all of the arguments on the command\nline.\n\n'--user NAME'\nList records for user with NAME. This is useful if you're trying\nto match a username that happens to be the same as a command (e.g.,\n'ed').\n\n'--command NAME'\nList records for command NAME.\n\n'--tty NAME'\nList records for tty NAME.\n\n'-f FILENAME'\n'--file FILENAME'\nRead from the file FILENAME instead of the system's 'acct' file.\n\n'--ahz HZ'\nUse this flag to tell the program what 'AHZ' should be (in hertz).\nThis option is useful if you are trying to view an 'acct' file\ncreated on another machine which has the same byte order and file\nformat as your current machine, but has a different value for\n'AHZ'.\n\n'-p'\n'--show-paging'\nPrint paging statistics\n\n'--debug'\nPrint verbose internal information.\n\n'--version'\nPrint 'lastcomm''s version number.\n\n'--help'\nPrint 'lastcomm''s usage string and default locations of system\nfiles to standard output.\n\nFile: accounting.info, Node: sa, Next: dump-acct, Prev: lastcomm, Up: Top\n" } ] }, "4 'sa'": { "content": "'sa' summarizes information about previously executed commands as\nrecorded in the 'acct' file. In addition, it condenses this data into\nthe 'savacct' summary file, which contains the number of times the\ncommand was called and the system resources used. The information can\nalso be summarized on a per-user basis; 'sa' will save this information\ninto 'usracct'. Usage:\n\n'sa [OPTS] [FILE]'\n\nIf no arguments are specified, 'sa' will print information about all\nof the commands in the 'acct' file. If command names have unprintable\ncharacters, or are only called once, 'sa' will sort them into a group\ncalled '*other'. Overall totals for each field are gathered and\nprinted with a blank command name.\n\nIf called with a file name as the last argument, 'sa' will use that\nfile instead of 'acct'.\n\nBy default, 'sa' will sort the output by sum of user and system time.\n\nThe output fields are labeled as follows:\n\n'cpu'\nsum of system and user time in cpu seconds\n\n're'\n\"real time\" in cpu seconds\n\n'k'\ncpu-time averaged core usage, in 1k units\n\n'avio'\naverage number of I/O operations per execution\n\n'tio'\ntotal number of I/O operations\n\n'k*sec'\ncpu storage integral (kilo-core seconds)\n\n'u'\nuser cpu time in cpu seconds\n\n's'\nsystem time in cpu seconds\n\nNote that these column titles do not appear in the first row of the\ntable, but after each numeric entry (as units of measurement) in every\nrow. For example, you might see '79.29re', meaning 79.29 cpu seconds of\n\"real time.\"\n\nAn asterisk will appear after the name of commands that forked but\ndidn't call 'exec'.\n", "subsections": [ { "name": "4.1 Flags", "content": "The availability of these program options depends on your operating\nsystem. In specific, the members that appear in the 'struct acct' of\nyour system's process accounting header file (usually 'acct.h')\ndetermine which flags will be present. For example, if your system's\n'struct acct' doesn't have the 'acmem' field, the installed version of\n'sa' will not support the '--sort-cpu-avmem', '--sort-ksec', '-k', or\n'-K' options.\n\nIn short, all of these flags may not be available on your machine.\n\n'-a'\n'--list-all-names'\nForce 'sa' not to sort those command names with unprintable\ncharacters and those used only once into the ''*other'' group.\n\n'-b'\n'--sort-sys-user-div-calls'\nSort the output by the sum of user and system time divided by the\nnumber of calls.\n\n'-c'\n'--percentages'\nPrint percentages of total time for the command's user, system, and\nreal time values.\n\n'-d'\n'--sort-avio'\nSort the output by the average number of disk I/O operations.\n\n'-D'\n'--sort-tio'\nPrint and sort the output by the total number of disk I/O\noperations.\n\n'-f'\n'--not-interactive'\nWhen using the '--threshold' option, assume that all answers to\ninteractive queries will be affirmative.\n\n'-i'\n'--dont-read-summary-file'\nDon't read the information in 'savacct'.\n\n'-j'\n'--print-seconds'\nInstead of printing total minutes for each category, print seconds\nper call.\n\n'-k'\n'--sort-cpu-avmem'\nSort the output by cpu time average memory usage.\n\n'-K'\n'--sort-ksec'\nPrint and sort the output by the cpu-storage integral.\n\n'-l'\n'--separate-times'\nPrint separate columns for system and user time; usually the two\nare added together and listed as 'cpu'.\n\n'-m'\n'--user-summary'\nPrint the number of processes and number of CPU minutes on a\nper-user basis.\n\n'-n'\n'--sort-num-calls'\nSort the output by the number of calls. This is the default\nsorting method.\n\n'-p'\n'--show-paging'\nPrint the number of minor and major pagefaults and swaps.\n\n'-P'\n'--show-paging-avg'\nPrint the number of minor and major pagefaults and swaps divided by\nthe number of calls.\n\n'-r'\n'--reverse-sort'\nSort output items in reverse order.\n\n'-s'\n'--merge'\nMerge the summarized accounting data into the summary files\n'savacct' and 'usracct'.\n\n'-t'\n'--print-ratio'\nFor each entry, print the ratio of real time to the sum of system\nand user times. If the sum of system and user times is too small\nto report--the sum is zero--'*ignore*' will appear in this field.\n\n'-u'\n'--print-users'\nFor each command in the accounting file, print the userid and\ncommand name. After printing all entries, quit. *Note*: this flag\nsupersedes all others.\n\n'-v NUM'\n'--threshold NUM'\nPrint commands which were executed NUM times or fewer and await a\nreply from the terminal. If the response begins with 'y', add the\ncommand to the 'junk' group.\n\n'--separate-forks'\nIt really doesn't make any sense to me that the stock version of\n'sa' separates statistics for a particular executable depending on\nwhether or not that command forked. Therefore, GNU 'sa' lumps this\ninformation together unless this option is specified.\n\n'--sort-real-time'\nSort the output by the \"real time\" (elapsed time) for each command.\n\n'--ahz HZ'\nUse this flag to tell the program what 'AHZ' should be (in hertz).\nThis option is useful if you are trying to view an 'acct' file\ncreated on another machine which has the same byte order and file\nformat as your current machine, but has a different value for\n'AHZ'.\n\n'--debug'\nPrint verbose internal information.\n\n'-V'\n'--version'\nPrint 'sa''s version number.\n\n'-h'\n'--help'\nPrint 'sa''s usage string and default locations of system files to\nstandard output.\n\n*Note*: if more than one sorting option is specified, the list will\nbe sorted by the one specified last on the command line.\n" }, { "name": "4.2 Problems", "content": "I haven't been able to test this on many different machines because the\ndata files grow so big in a short time; our sysadmin would rather save\nthe disk space.\n\nMost versions of 'sa' that I've tested don't pay attention to flags\nlike '--print-seconds' and '--sort-num-calls' when printing out commands\nwhen combined with the '--user-summary' or '--print-users' flags. GNU\n'sa' pays attention to these flags if they are applicable.\n\n\nThe average memory use is stored as a short rather than a double, so we\nsuffer from round-off errors. GNU 'sa' uses double the whole way\nthrough.\n\nFile: accounting.info, Node: dump-acct, Prev: sa, Up: Top\n" } ] }, "5 'dump-acct'": { "content": "'dump-acct' dumps some of the contents of one or more 'acct' files in\nhuman readable form. Usage:\n\n'dump-acct [OPTS] FILES'\n\nUnless called with the '--raw' option, it prints a table with the\nfollowing fields, separated by vertical bars('|'):\n\n'accomm'\nname of the executed program\n\n'acversion'\nversion of the 'acct' file format\n\n'acutime'\nuser time\n\n'acstime'\nsystem time\n\n'acetime'\nelapsed time\n\n'acuid'\nuser id\n\n'acgid'\ngroup id\n\n'acmem'\n(average) memory usage\n\n'acio'\nnumber of characters transferred on input/output\n\n'acpid'\nprocess id\n\n'acppid'\nparent's process id\n\nAll times will be given in platform dependent units (\"'AHZ'\"). Not\nall of the above columns will actually appear, depending on what\ninformation your operating system provides in it's 'struct acct'.\n", "subsections": [ { "name": "5.1 Flags", "content": "'--ahz HZ'\nUse this flag to tell the program what 'AHZ' should be (in Hertz).\nThis option is useful if you are trying to view an 'acct' file\ncreated on another machine which has a different value for 'AHZ'.\n\n'--byteswap'\nSwap the bytes (relative to your system's native byte order) in\n'--raw' output.\n\n'--format'\nSet output format with '--raw' option.\n\n'-n NUM'\n'--num NUM'\nLimit the number of lines (or records with '--raw') to print.\n\n'-r'\n'--reverse'\nRead the accounting file backwards (print latest record first).\n\n'-R'\n'--raw'\nDon't print human readable output, dump the raw record instead.\nUseful to convert between different Linux file formats (see below).\n\n'-h'\n'--help'\nPrint 'dump-acct''s usage string and default location of the\naccouning file to standard output.\n\n'--byteswap' and '--format' options are only available with Linux\nmultiformat support. They only affect output with the '--raw' option,\nformat and byte order of the input are automatically detected. Thus\nthey are useful to convert between different file formats.\n\nThe '--ahz' option affects input and output (except for v3 file\nformat, which by definition is fixed to 'AHZ=100'). If you ever need to\nconvert between different 'AHZ' values, use a two-step process: First\nconvert to v3 format with the old 'AHZ' value, then convert to the\ndesired output format with the new 'AHZ' setting.\n\n" } ] } } } }