Table 10-2 Daily Accounting Reports
Jan 16 02:30 2004 DAILY REPORT FOR venus Page 1 from Mon Jan 15 02:30:02 2004 to Tue Oan 16 02:30:01 2004 1 runacct 1 acctcon TOTAL DURATION IS 1440 MINUTES LINE MINUTES PERCENT # SESS # ON # OFF console 868 60 1 1 2 TOTALS 868 -- 1 1 2
The from and to lines specify the time period reflected in the report. This time period covers the time the last Daily Report was generated to the time the current Daily Report was generated. Then, the report presents a log of system reboots, shutdowns, power failure recoveries, and any other record written to the /var/adm/wtmpx file by the acctwtmp program. For more information, see the acct(1M) man page.
The second part of the report is a breakdown of terminal line utilization. The TOTAL DURATION tells how long the system was in multiuser mode (accessible through the terminal lines). The following list describes the data provided by the Daily Report.
The terminal line or access port.
The number of minutes that the line was in use during the accounting period.
The TOTAL DURATION divided by the number of MINUTES.
The number of times this line or port was accessed for a login session.
Same as SESS. (This column no longer has meaning. Previously, this column listed the number of times that a line or port was used to log in a user.)
The number of times a user logs out and any interrupts that occur on that line. Generally, interrupts occur on a port when ttymon is first invoked after the system is brought to multiuser mode. If the # OFF exceeds the # SESS by a large factor, the multiplexer, modem, or cable is probably going bad. Or, a bad connection exists somewhere. The most common cause is an unconnected cable dangling from the multiplexer.
During real time, you should monitor the /var/adm/wtmpx file because it is the file from which the connect accounting is derived. If the wtmpx file grows rapidly, execute the following command to see which tty line is the noisiest.
# /usr/lib/acct/acctcon -l file < /var/adm/wtmpx
If interruption is occurring frequently, general system performance will be affected. Additionally, the wtmp file might become corrupted. To correct this problem, see How to Fix a Corrupted wtmpx File.
Jan 16 02:30 2004 DAILY USAGE REPORT FOR skisun Page 1 LOGIN CPU (MINS) KCORE- MINS CONNECT (MINS) DISK # OF # OF # DISK FEE UID NAME PRIME NPRIME PRIME NPRIME PRIME NPRIME BLOCKS PROCS SESS SAMPLES 0 TOTAL 72 148 11006173 51168 26230634 57792 539 330 0 2150 1 0 root 32 76 11006164 33664 26230616 22784 0 0 0 127 0 4 adm 0 0 22 51 0 0 0 420 0 0 0 101 rimmer 39 72 894385 1766020 539 330 0 1603 1 0 0
The following table describes the data provided by the Daily Usage Report.
Table 10-3 Daily Usage Report Data
The Daily Command Summary report shows the system resource utilization by command. With this report, you can identify the most heavily used commands. Based on how those commands use system resources, you can then gain insight on how best to tune the system.
These reports are sorted by TOTAL KCOREMIN, which is an arbitrary gauge but often useful for calculating drain on a system.
A sample Daily Command Summary follows:
TOTAL COMMAND SUMMARY COMMAND NUMBER TOTAL TOTAL TOTAL MEAN MEAN HOG CHARS BLOCKS NAME CMDS KCOREMIN CPU-MIN REAL-MIN SIZE-K CPU-MIN FACTOR TRNSFD READ TOTALS 2150 1334999.75 219.59 724258.50 6079.48 0.10 0.00 397338982 419448 netscape 43 2456898.50 92.03 54503.12 26695.51 2.14 0.00 947774912 225568 adeptedi 7 88328.22 4.03 404.12 21914.95 0.58 0.01 93155160 8774 dtmail 1 54919.17 5.33 17716.57 10308.94 5.33 0.00 213843968 40192 acroread 8 31218.02 2.67 17744.57 11682.66 0.33 0.00 331454464 11260 dtwm 1 16252.93 2.53 17716.57 6416.05 2.53 0.00 158662656 12848 dtterm 5 4762.71 1.30 76300.29 3658.93 0.26 0.00 33828352 11604 dtaction 23 1389.72 0.33 0.60 4196.43 0.01 0.55 18653184 539 dtsessio 1 1174.87 0.24 17716.57 4932.97 0.24 0.00 23535616 5421 dtcm 1 866.30 0.18 17716.57 4826.21 0.18 0.00 3012096 6490
The following list describes the data provided by the Daily Command Summary.
Name of the command. All shell procedures are lumped together under the name sh because only object modules are reported by the process accounting system. You should monitor the frequency of programs called a.out or core, or any other unexpected name. You can use the acctcom program to determine who executed an oddly named command and if superuser privileges were used.
Total number of times this command was run.
Total cumulative measurement of the Kbyte segments of memory used by a process per minute of run time.
Total processing time this program accumulated.
Total real-time (wall-clock) minutes this program accumulated.
Mean (average) of the TOTAL KCOREMIN over the number of invocations reflected by the NUMBER CMDS.
Mean (average) derived from the NUMBER CMDS and the TOTAL CPU-MIN.
Total CPU time divided by elapsed time. Shows the ratio of system availability to system utilization, providing a relative measure of total available CPU time consumed by the process during its execution.
Total number of characters transferred by the read and write system calls. Might be negative due to overflow.
Total number of the physical block reads and writes that a process performed.
The format of the Daily Command Summary and the Monthly Command Summary reports are virtually the same. However, the daily summary reports only on the current accounting period while the monthly summary reports on the start of the fiscal period to the current date. In other words, the monthly report is a cumulative summary that reflects the data accumulated since the last invocation of the monacct program.
Jan 16 02:30 2004 MONTHLY TOTAL COMMAND SUMMARY Page 1 TOTAL COMMAND SUMMARY COMMAND NUMBER TOTAL TOTAL TOTAL MEAN MEAN HOG CHARS BLOCKS NAME CMDS KCOREMIN CPU-MIN REAL-MIN SIZE-K CPU-MIN FACTOR TRNSFD READ TOTALS 42718 4398793.50 361.92 956039.00 12154.09 0.01 0.00 16100942848 825171 netscape 789 3110437.25 121.03 79101.12 25699.58 0.15 0.00 3930527232 302486 adeptedi 84 1214419.00 50.20 4174.65 24193.62 0.60 0.01 890216640 107237 acroread 145 165297.78 7.01 18180.74 23566.84 0.05 0.00 1900504064 26053 dtmail 2 64208.90 6.35 20557.14 10112.43 3.17 0.00 250445824 43280 dtaction 800 47602.28 11.26 15.37 4226.93 0.01 0.73 640057536 8095 soffice. 13 35506.79 0.97 9.23 36510.84 0.07 0.11 134754320 5712 dtwm 2 20350.98 3.17 20557.14 6419.87 1.59 0.00 190636032 14049
For a description of the data provided by the Monthly Command Summary, see Daily Command Summary.
This report gives the date when a particular login was last used. You can use this information to find unused logins and login directories that can be archived and deleted. A Last Login Report follows.
Jan 16 02:30 2004 LAST LOGIN Page 1 01-06-12 kryten 01-09-08 protoA 01-10-14 ripley 01-07-14 lister 01-09-08 protoB 01-10-15 scutter1 01-08-16 pmorph 01-10-12 rimmer 01-10-16 scutter2
At any time, you can examine the contents of the /var/adm/pacctn files, or any file with records in the acct.h format, by using the acctcom program. If you do not specify any files and do not provide any standard input when you run this command, the acctcom command reads the pacct file. Each record read by the acctcom command represents information about a terminated process. Active processes can be examined by running the ps command.
The default output of the acctcom command provides the following information:
# acctcom COMMAND START END REAL CPU MEAN NAME USER TTYNAME TIME TIME (SECS) (SECS) SIZE(K) #accton root ? 02:30:01 02:30:01 0.03 0.01 304.00 turnacct adm ? 02:30:01 02:30:01 0.42 0.01 320.00 mv adm ? 02:30:01 02:30:01 0.07 0.01 504.00 utmp_upd adm ? 02:30:01 02:30:01 0.03 0.01 712.00 utmp_upd adm ? 02:30:01 02:30:01 0.01 0.01 824.00 utmp_upd adm ? 02:30:01 02:30:01 0.01 0.01 912.00 utmp_upd adm ? 02:30:01 02:30:01 0.01 0.01 920.00 utmp_upd adm ? 02:30:01 02:30:01 0.01 0.01 1136.00 utmp_upd adm ? 02:30:01 02:30:01 0.01 0.01 576.00 closewtm adm ? 02:30:01 02:30:01 0.10 0.01 664.00
The following list describes each field:
Command name (pound (#) sign if the command was executed with superuser privileges)
tty name (listed as ? if unknown)
Command execution starting time
Command execution ending time
Real time (in seconds)
CPU time (in seconds)
Mean size (in Kbytes)
You can obtain the following information by using acctcom command options.
State of the fork/exec flag (1 for fork without exec)
System exit status
Total kcore minutes
Shows average statistics about the processes selected. The statistics are printed after the output is recorded.
Reads the files backward, showing latest commands first. This option has no effect if reading standard input.
Prints the fork/exec flag and system exit status columns. The output is an octal number.
Instead of mean memory size, shows the hog factor, which is the fraction of total available CPU time consumed by the process during its execution. Hog factor = total-CPU-time/elapsed-time.
Prints columns that contains the I/O counts in the output.
Shows total kcore minutes instead of memory size.
Shows mean core size. This size is the default.
Prints average statistics, not output records.
Shows CPU factor: user-time/(system-time + user-time).
Shows separate system and user CPU times.
Excludes column headings from the output.
Shows only processes with total CPU time (system plus user) that exceeds sec seconds.
Shows processes existing at or before time, given in the format hr[:min[:sec]].
Shows processes starting at or before time, given in the format hr[:min[:sec]]. Using the same time for both -S and -E, shows processes that existed at the time.
Shows only processes that belong to group.
Shows only processes that exceed factor, where factor is the “hog factor” (see the -h option).
Shows only processes that transferred more characters than the cutoff number specified by chars.
Show only processes that belong to the terminal /dev/line.
Shows only commands that match pattern (a regular expression except that “+” means one or more occurrences).
Instead of printing the records, copies them in acct.h format to ofile.
Shows only processes with CPU system time that exceeds sec seconds.
Show processes existing at or after time, given in the format hr[:min[:sec]].
Show processes starting at or after time, given in the format hr[:min[:sec]].
Shows only processes that belong to user.