System Administration Guide

Daily Accounting Reports

The runacct shell script generates four basic reports upon each invocation. These reports cover the areas of connect accounting, usage by login on a daily basis, command usage reported by daily and monthly totals, and a report of the last time users were logged in. Table 61-2 describes the four basic reports generated.

Table 61-2 Daily Accounting Reports


Report Type	Description
Daily Report	Shows line utilization by `tty` number.
Daily Usage Report	Indicates usage of system resources by users (listed in order of UID).
Daily Command Summary	Indicates usage of system resources by commands, listed in descending order of use of memory (in other words, the command that used the most memory is listed first). This same information is reported for the month with the monthly total command summary.
Last Login	Shows the last time each user logged in (arranged in chronological order).

Daily Report

This report gives information about each terminal line used. A sample daily report appears below.

Feb 27 12:25 1997  DAILY REPORT FOR mercury Page 1
 
 
from Wed Feb 26 13:21:58 1997
to   Thu Feb 27 12:25:33 1997
1       system boot
1       run-level 3
1       acctg on
1       runacct
1       acctcon
 
TOTAL DURATION IS 1384 MINUTES
LINE         MINUTES  PERCENT  # SESS  # ON  # OFF
/dev/pts/5   0        0        0       0     0   
/dev/pts/6   0        0        0       0     1   
/dev/pts/7   0        0        0       0     0   
console      1337     97       1       1     1   
pts/3        0        0        0       0     1   
pts/4        0        0        0       0     1   
pts/5        3        0        2       2     3   
pts/6        232      17       5       5     5   
pts/7        54       4        1       1     2   
pts/8        0        0        0       0     1   
pts/9        0        0        0       0     1   
TOTALS       1625     --       9       9     16

The from and to lines specify the time period reflected in the report--the period from the time the last accounting report was generated until the time the current accounting report was generated. It is followed by a log of system reboots, shutdowns, power failure recoveries, and any other record dumped into /var/adm/wtmp by the acctwtmp program. For more information, see acct(1M).

The second part of the report is a breakdown of line utilization. The TOTAL DURATION tells how long the system was in multiuser state (accessible through the terminal lines). The columns are described in Table 61-3.

Table 61-3 Daily Report Data


Column	Description
`LINE`	The terminal line or access port.
`MINUTES`	The total number of minutes that the line was in use during the accounting period.
`PERCENT`	The total number of `MINUTES` the line was in use, divided into the `TOTAL` `DURATION`.
`# SESS`	The number of times this port was accessed for a login session.
`# ON`	Identical to `SESS`. (This column does not have much meaning anymore. Previously, it listed the number of times that a port was used to log in a user.)
`# OFF`	This column reflects the number of times a user logs out and any interrupts that occur on that line. Generally, interrupts occur on a port when `ttymon` is first invoked after the system is brought to multiuser state. If the `# OFF` exceeds the `# ON` by a large factor, the multiplexer, modem, or cable is probably going bad, or there is a bad connection somewhere. The most common cause of this is an unconnected cable dangling from the multiplexer.

During real time, you should monitor /var/adm/wtmp because it is the file from which the connect accounting is geared. If the wtmp file grows rapidly, execute acctcon -l file < /var/adm/wtmp to see which tty line is the noisiest. If interruption is occurring frequently, general system performance will be affected. Additionally, wtmp may become corrupted. To correct this, see "How to Fix a wtmp File".

Daily Usage Report

The daily usage report gives a breakdown of system resource utilization by user. A sample of this type of report appears below.

Feb 27 12:25 1997  DAILY USAGE REPORT FOR mercury Page 1
 
      LOGIN    CPU (MINS) KCORE-MINS  CONNECT (MINS) DISK  # OF  # OF # DISK FEE
UID   NAME   PRIME NPRIME PRIME NPRIME PRIME NPRIME  BLOCKS PROCS SESS SAMPLES
0     TOTAL  1     1      2017  717    785   840    660361  1067  9     7    20
0     root   1     1      1833  499    550   840    400443  408   2     1    0
1     daemon 0     0      0     0      0     0      400     0     0     1    0
2     bin    0     0      0     0      0     0      253942  0     0     1    0
3     sys    0     0      0     0      0     0      2       0     0     1    0
4     adm    0     0      46    83     0     0      104     280   0     1    0
5     uucp   0     0      74    133    0     0      1672    316   0     1    0
71    lp     0     0      0     2      0     0      3798    1     0     1    0
8198  ksm    0     0      8     0      0     0      0       6     1     0    0
52171 pjm    0     0      56    0      234   0      0       56    6     0    20

The data provided in the daily usage report is described in Table 61-4.

Table 61-4 Daily Usage Report Data


Column	Description
`UID`	User identification number.
`LOGIN NAME`	Login name of the user. Identifies a user who has multiple login names.
`CPU-MINS`	Amount of time, in minutes, that the user's process used the central processing unit. Divided into `PRIME` and `NPRIME` (non-prime) utilization. The accounting system's version of this data is located in the `/etc/acct/holidays` file.
`KCORE-MINS`	A cumulative measure of the amount of memory in kbyte segments per minute that a process uses while running. Divided into `PRIME` and `NPRIME` utilization.
`CONNECT-MINS`	Amount of time a user was logged into the system, or "real time." Divided into `PRIME` and `NPRIME` use. If these numbers are high while the `# OF PROCS` is low, you can conclude that the user logs in first thing in the morning and hardly touches the terminal the rest of the day.
`DISK BLOCKS`	Output from the `acctdusg` program, which runs and merges disk accounting programs and total accounting record (`daytacct`). (For accounting purposes, a block is 512 bytes.)
`# OF PROCS`	Number of processes invoked by the user. If large numbers appear, a user may have a shell procedure that has run out of control.
`# OF SESS`	Number of times a user logged on to the system.
`# DISK SAMPLES`	Number of times disk accounting was run to obtain the average number of `DISK BLOCKS`.
`FEE`	Often unused field that represents the total accumulation of units charged against the user by `chargefee`.

Daily Command Summary

The daily command summary report shows the system resource use by command. With this report, you can identify the most heavily used commands and, based on how those commands use system resources, gain insight on how best to tune the system. The format of the daily and monthly reports are virtually the same; however, the daily summary reports only on the current accounting period while the monthly summary reports on the start of the fiscal period to the current date. In other words, the monthly report reflects the data accumulated since the last invocation of monacct.

These reports are sorted by TOTAL KCOREMIN, which is an arbitrary gauge but often a good one for calculating drain on a system.

A sample daily command summary appears below.

Feb 27 12:25 1997  DAILY COMMAND SUMMARY Page 1
 
                                   TOTAL COMMAND SUMMARY
COMMAND NUMBER    TOTAL    TOTAL    TOTAL   MEAN    MEAN    HOG    CHARS  BLOCKS
NAME     CMDS  KCOREMIN  CPU-MIN  REAL-MIN  SIZE-K  CPU-MIN FACTOR TRNSFD   READ
 
TOTALS   1067   2730.99    2.01    1649.38 1361.41   0.00  0.00    6253571  2305
 
sendmail   28   1085.87    0.05      0.24  23865.20  0.00  0.19     101544    39
admintoo    3    397.68    0.12   1132.96  3443.12   0.04  0.00     680220    83 
sh        166    204.78    0.31    161.13  651.80    0.00  0.00     598158    20 
nroff      12    167.17    0.14      0.24  1205.55   0.01  0.59     709048    22 
find       10    151.27    0.27      2.72  563.40    0.03  0.10     877971  1580
acctdusg    3     87.40    0.13      2.74  698.29    0.04  0.05     883845   203 
lp         10     74.29    0.05      0.22  1397.38   0.01  0.24     136460    57 
expr       20     67.48    0.02      0.06  3213.24   0.00  0.34       6380     1 
mail.loc    3     65.83    0.01      0.04  11285.60  0.00  0.15      24709    15
cmdtool     1     37.65    0.02     20.13  2091.56   0.02  0.00     151296     1 
uudemon.  105     37.38    0.09      0.32  435.46    0.00  0.27      62130    17 
csh         6     35.17    0.05     57.28  756.30    0.01  0.00     209560    13 
col        12     31.12    0.06      0.26  523.00    0.00  0.23     309932     0 
ntpdate    22     27.55    0.05     11.18  599.00    0.00  0.00      22419     0 
uuxqt      44     18.66    0.04      0.06  417.79    0.00  0.74      32604     3 
man        12     15.11    0.03      7.05  503.67    0.00  0.00      85266    47
.  
. 
.

The data provided, by column, in the daily command summary is described in Table 61-5.

Table 61-5 Daily Command Summary


Column	Description
`COMMAND NAME`	Name of the command. Unfortunately, all shell procedures are lumped together under the name `sh` because only object modules are reported by the process accounting system. It's a good idea to monitor the frequency of programs called `a.out` or `core` or any other unexpected name. `acctcom` can be used to determine who executed an oddly named command and if superuser privileges were used.
`NUMBER CMNDS`	Total number of invocations of this particular command during prime time.
`TOTAL KCOREMIN`	Total cumulative measurement of the Kbyte segments of memory used by a process per minute of run time.
`TOTAL CPU-MIN:`	Total processing time this program has accumulated during prime time.
`TOTAL REAL-MIN`	Total real-time (wall-clock) minutes this program has accumulated.
`MEAN SIZE-K`	Mean of the `TOTAL` `KCOREMIN` over the number of invocations reflected by `NUMBER` `CMDS`.
`MEAN CPU-MIN`	Mean derived between the `NUMBER` `CMDS` and `TOTAL CPU-MIN`.
`HOG FACTOR`	Total CPU time divided by elapsed time. Shows the ratio of system availability to system use, providing a relative measure of total available CPU time consumed by the process during its execution.
`CHARS TRNSFD`	Total count of the number of characters pushed around by the read and write system calls. May be negative due to overflow.
`BLOCKS READ`	Total count of the physical block reads and writes that a process performed.

Monthly Command Summary

The monthly command summary is similar to the daily command summary. The only difference is that the monthly command summary shows totals accumulated since the last invocation of monacct. A sample report appears below.

Mar  4 02:30 1997  MONTHLY TOTAL COMMAND SUMMARY Page 1
 
                                     TOTAL COMMAND SUMMARY
COMMAND NUMBER     TOTAL    TOTAL     TOTAL   MEAN   MEAN   HOG    CHARS  BLOCKS
NAME      CMDS  KCOREMIN   CPU-MIN REAL-MIN SIZE-K CPU-MIN FACTOR TRNSFD   READ
 
TOTALS     771    483.70   0.94    8984.09  515.12   0.00  0.00   2248299   179 
 
sh         105    155.41   0.23     429.58  667.94   0.00  0.00    491870     1 
uudemon.    85     29.39   0.07       0.29  434.28   0.00  0.23     49630    14 
acctcms      5     27.21   0.04       0.04  752.41   0.01  0.90    218880     1 
ntpdate     17     21.30   0.04      14.10  605.73   0.00  0.00     18192     0 
dtpad        1     19.69   0.01      10.87 2072.70   0.01  0.00     46992     8 
sendmail    17     16.75   0.02       0.02  859.04   0.00  0.91     1965      0 
acctprc      1     14.92   0.03       0.03  552.69   0.03  0.95    115584     0 
uuxqt       34     14.78   0.03       0.04  426.29   0.00  0.92     25194     0 
uusched     34     10.96   0.03       0.03  363.25   0.00  0.91     25194     0 
sed         40     10.15   0.03       0.09  315.50   0.00  0.36     64162     2 
man          5     10.08   0.02      57.58  555.05   0.00  0.00     25773     2 
getent       1      7.68   0.01       0.02  921.60   0.01  0.40     20136     0 
in.rlogi     5      7.65   0.01    4331.67  611.73   0.00  0.00     87440     0 
cp          37      7.28   0.03       0.05  280.08   0.00  0.50     1739     36 
date        27      7.24   0.02       0.03  329.12   0.00  0.65     23443     1 
ls          15      7.05   0.01       0.02  503.33   0.00  0.79     14123     0 
awk         19      6.94   0.02       0.06  372.04   0.00  0.32       666     0 
rm          29      6.83   0.02       0.04  301.32   0.00  0.60      2348    17

See "Daily Command Summary " for a description of the data.

Last Login Report

This report gives the date when a particular login was last used. You can use this information to find unused logins and login directories that may be archived and deleted. A sample report appears below.

Feb 27 12:25 1997  LAST LOGIN Page 1  
. 
.  
.
00-00-00  arimmer       00-00-00  lister        97-02-27  pjm
00-00-00  reception     00-00-00  smithey       97-02-27  ksm
00-00-00  release       00-00-00  smsc          97-02-27  root
00-00-00  resch         00-00-00  smtp

Looking at the `pacct` File With `acctcom`

At any time, you can examine the contents of the /var/adm/pacctn files, or any file with records in the acct.h format, by using the acctcom program. If you don't specify any files and don't provide any standard input when you run this command, acctcom reads the pacct file. Each record read by acctcom represents information about a dead process (active processes may be examined by running the ps command). The default output of acctcom provides the following information:

Command name (pound (#) sign if it was executed with superuser privileges)
User
tty name (listed as ? if unknown)
Starting time
Ending time
Real time (in seconds)
CPU time (in seconds)
Mean size (in Kbytes)

The following information can be obtained by using options to acctcom:

State of the fork/exec flag (1 for fork without exec)
System exit status
Hog factor
Total kcore minutes
CPU factor
Characters transferred
Blocks read

Table 61-6 describes the acctcom options.

Table 61-6 acctcom Options


Option	Description
`-a`	Show some average statistics about the processes selected. (The statistics are printed after the output is recorded.)
`-b`	Read the files backward, showing latest commands first. (This has no effect if reading standard input.)
`-f`	Print the `fork/exec` flag and system exit status columns. (The output is an octal number.)
`-h`	Instead of mean memory size, show the hog factor, which is the fraction of total available CPU time consumed by the process during its execution. Hog factor = total_CPU_time/elapsed_time.
`-i`	Print columns containing the I/O counts in the output.
`-k`	Show total `kcore` `minutes` instead of memory size.
`-m`	Show mean core size (this is the default).
`-q`	Don't print output records, just print average statistics.
`-r`	Show CPU factor: `user_time`/(`system_time + user_tim`e).
`-t`	Show separate system and user CPU times.
`-v`	Exclude column headings from the output.
`-C` `sec`	Show only processes with total CPU time (system plus user) exceeding `sec` seconds.
`-e` `time`	Show processes existing at or before time, given in the format hr[:min[:sec]].
`-E` `time`	Show processes starting at or before time, given in the format hr[:min[:sec]]. Using the same time for both `-S` and `-E`, show processes that existed at the time.
`-g` `group`	Show only processes belonging to group.
`-H` `factor`	Show only processes that exceed factor, where factor is the "hog factor" (see the `-h` option).
`-I` `chars`	Show only processes transferring more characters than the cutoff number specified by chars.
`-l` `line`	Show only processes belonging to the terminal `/dev/line`.
`-n` `pattern`	Show only commands matching pattern (a regular expression except that "`+`" means one or more occurrences).
`-o` `ofile`	Instead of printing the records, copy them in `acct.h` format to ofile.
`-O` `sec`	Show only processes with CPU system time exceeding sec seconds.
`-s` `time`	Show processes existing at or after time, given in the format `hr`[:`min`[:`sec`]].
`-S` `time`	Show processes starting at or after time, given in the format `hr`[:min[:sec]].
`-u` `user`	Show only processes belonging to user.