The runacct shell script generates four basic reports upon each invocation. These reports cover the areas of connect accounting, usage by login on a daily basis, command usage reported by daily and monthly totals, and a report of the last time users were logged in. Table 61-2 describes the four basic reports generated.
Table 61-2 Daily Accounting Reports
This report gives information about each terminal line used. A sample daily report appears below.
Feb 27 12:25 1997 DAILY REPORT FOR mercury Page 1 from Wed Feb 26 13:21:58 1997 to Thu Feb 27 12:25:33 1997 1 system boot 1 run-level 3 1 acctg on 1 runacct 1 acctcon TOTAL DURATION IS 1384 MINUTES LINE MINUTES PERCENT # SESS # ON # OFF /dev/pts/5 0 0 0 0 0 /dev/pts/6 0 0 0 0 1 /dev/pts/7 0 0 0 0 0 console 1337 97 1 1 1 pts/3 0 0 0 0 1 pts/4 0 0 0 0 1 pts/5 3 0 2 2 3 pts/6 232 17 5 5 5 pts/7 54 4 1 1 2 pts/8 0 0 0 0 1 pts/9 0 0 0 0 1 TOTALS 1625 -- 9 9 16 |
The from and to lines specify the time period reflected in the report--the period from the time the last accounting report was generated until the time the current accounting report was generated. It is followed by a log of system reboots, shutdowns, power failure recoveries, and any other record dumped into /var/adm/wtmp by the acctwtmp program. For more information, see acct(1M).
The second part of the report is a breakdown of line utilization. The TOTAL DURATION tells how long the system was in multiuser state (accessible through the terminal lines). The columns are described in Table 61-3.
Table 61-3 Daily Report Data
During real time, you should monitor /var/adm/wtmp because it is the file from which the connect accounting is geared. If the wtmp file grows rapidly, execute acctcon -l file < /var/adm/wtmp to see which tty line is the noisiest. If interruption is occurring frequently, general system performance will be affected. Additionally, wtmp may become corrupted. To correct this, see "How to Fix a wtmp File".
The daily usage report gives a breakdown of system resource utilization by user. A sample of this type of report appears below.
Feb 27 12:25 1997 DAILY USAGE REPORT FOR mercury Page 1 LOGIN CPU (MINS) KCORE-MINS CONNECT (MINS) DISK # OF # OF # DISK FEE UID NAME PRIME NPRIME PRIME NPRIME PRIME NPRIME BLOCKS PROCS SESS SAMPLES 0 TOTAL 1 1 2017 717 785 840 660361 1067 9 7 20 0 root 1 1 1833 499 550 840 400443 408 2 1 0 1 daemon 0 0 0 0 0 0 400 0 0 1 0 2 bin 0 0 0 0 0 0 253942 0 0 1 0 3 sys 0 0 0 0 0 0 2 0 0 1 0 4 adm 0 0 46 83 0 0 104 280 0 1 0 5 uucp 0 0 74 133 0 0 1672 316 0 1 0 71 lp 0 0 0 2 0 0 3798 1 0 1 0 8198 ksm 0 0 8 0 0 0 0 6 1 0 0 52171 pjm 0 0 56 0 234 0 0 56 6 0 20 |
The data provided in the daily usage report is described in Table 61-4.
Table 61-4 Daily Usage Report Data
The daily command summary report shows the system resource use by command. With this report, you can identify the most heavily used commands and, based on how those commands use system resources, gain insight on how best to tune the system. The format of the daily and monthly reports are virtually the same; however, the daily summary reports only on the current accounting period while the monthly summary reports on the start of the fiscal period to the current date. In other words, the monthly report reflects the data accumulated since the last invocation of monacct.
These reports are sorted by TOTAL KCOREMIN, which is an arbitrary gauge but often a good one for calculating drain on a system.
A sample daily command summary appears below.
Feb 27 12:25 1997 DAILY COMMAND SUMMARY Page 1 TOTAL COMMAND SUMMARY COMMAND NUMBER TOTAL TOTAL TOTAL MEAN MEAN HOG CHARS BLOCKS NAME CMDS KCOREMIN CPU-MIN REAL-MIN SIZE-K CPU-MIN FACTOR TRNSFD READ TOTALS 1067 2730.99 2.01 1649.38 1361.41 0.00 0.00 6253571 2305 sendmail 28 1085.87 0.05 0.24 23865.20 0.00 0.19 101544 39 admintoo 3 397.68 0.12 1132.96 3443.12 0.04 0.00 680220 83 sh 166 204.78 0.31 161.13 651.80 0.00 0.00 598158 20 nroff 12 167.17 0.14 0.24 1205.55 0.01 0.59 709048 22 find 10 151.27 0.27 2.72 563.40 0.03 0.10 877971 1580 acctdusg 3 87.40 0.13 2.74 698.29 0.04 0.05 883845 203 lp 10 74.29 0.05 0.22 1397.38 0.01 0.24 136460 57 expr 20 67.48 0.02 0.06 3213.24 0.00 0.34 6380 1 mail.loc 3 65.83 0.01 0.04 11285.60 0.00 0.15 24709 15 cmdtool 1 37.65 0.02 20.13 2091.56 0.02 0.00 151296 1 uudemon. 105 37.38 0.09 0.32 435.46 0.00 0.27 62130 17 csh 6 35.17 0.05 57.28 756.30 0.01 0.00 209560 13 col 12 31.12 0.06 0.26 523.00 0.00 0.23 309932 0 ntpdate 22 27.55 0.05 11.18 599.00 0.00 0.00 22419 0 uuxqt 44 18.66 0.04 0.06 417.79 0.00 0.74 32604 3 man 12 15.11 0.03 7.05 503.67 0.00 0.00 85266 47 . . . |
The data provided, by column, in the daily command summary is described in Table 61-5.
Table 61-5 Daily Command Summary
The monthly command summary is similar to the daily command summary. The only difference is that the monthly command summary shows totals accumulated since the last invocation of monacct. A sample report appears below.
Mar 4 02:30 1997 MONTHLY TOTAL COMMAND SUMMARY Page 1 TOTAL COMMAND SUMMARY COMMAND NUMBER TOTAL TOTAL TOTAL MEAN MEAN HOG CHARS BLOCKS NAME CMDS KCOREMIN CPU-MIN REAL-MIN SIZE-K CPU-MIN FACTOR TRNSFD READ TOTALS 771 483.70 0.94 8984.09 515.12 0.00 0.00 2248299 179 sh 105 155.41 0.23 429.58 667.94 0.00 0.00 491870 1 uudemon. 85 29.39 0.07 0.29 434.28 0.00 0.23 49630 14 acctcms 5 27.21 0.04 0.04 752.41 0.01 0.90 218880 1 ntpdate 17 21.30 0.04 14.10 605.73 0.00 0.00 18192 0 dtpad 1 19.69 0.01 10.87 2072.70 0.01 0.00 46992 8 sendmail 17 16.75 0.02 0.02 859.04 0.00 0.91 1965 0 acctprc 1 14.92 0.03 0.03 552.69 0.03 0.95 115584 0 uuxqt 34 14.78 0.03 0.04 426.29 0.00 0.92 25194 0 uusched 34 10.96 0.03 0.03 363.25 0.00 0.91 25194 0 sed 40 10.15 0.03 0.09 315.50 0.00 0.36 64162 2 man 5 10.08 0.02 57.58 555.05 0.00 0.00 25773 2 getent 1 7.68 0.01 0.02 921.60 0.01 0.40 20136 0 in.rlogi 5 7.65 0.01 4331.67 611.73 0.00 0.00 87440 0 cp 37 7.28 0.03 0.05 280.08 0.00 0.50 1739 36 date 27 7.24 0.02 0.03 329.12 0.00 0.65 23443 1 ls 15 7.05 0.01 0.02 503.33 0.00 0.79 14123 0 awk 19 6.94 0.02 0.06 372.04 0.00 0.32 666 0 rm 29 6.83 0.02 0.04 301.32 0.00 0.60 2348 17 |
See "Daily Command Summary " for a description of the data.
This report gives the date when a particular login was last used. You can use this information to find unused logins and login directories that may be archived and deleted. A sample report appears below.
Feb 27 12:25 1997 LAST LOGIN Page 1 . . . 00-00-00 arimmer 00-00-00 lister 97-02-27 pjm 00-00-00 reception 00-00-00 smithey 97-02-27 ksm 00-00-00 release 00-00-00 smsc 97-02-27 root 00-00-00 resch 00-00-00 smtp |
At any time, you can examine the contents of the /var/adm/pacctn files, or any file with records in the acct.h format, by using the acctcom program. If you don't specify any files and don't provide any standard input when you run this command, acctcom reads the pacct file. Each record read by acctcom represents information about a dead process (active processes may be examined by running the ps command). The default output of acctcom provides the following information:
Command name (pound (#) sign if it was executed with superuser privileges)
User
tty name (listed as ? if unknown)
Starting time
Ending time
Real time (in seconds)
CPU time (in seconds)
Mean size (in Kbytes)
The following information can be obtained by using options to acctcom:
State of the fork/exec flag (1 for fork without exec)
System exit status
Hog factor
Total kcore minutes
CPU factor
Characters transferred
Blocks read
Table 61-6 describes the acctcom options.
Option |
Description |
---|---|
-a |
Show some average statistics about the processes selected. (The statistics are printed after the output is recorded.) |
-b
|
Read the files backward, showing latest commands first. (This has no effect if reading standard input.) |
-f |
Print the fork/exec flag and system exit status columns. (The output is an octal number.) |
-h |
Instead of mean memory size, show the hog factor, which is the fraction of total available CPU time consumed by the process during its execution. Hog factor = total_CPU_time/elapsed_time. |
-i |
Print columns containing the I/O counts in the output. |
-k |
Show total kcore minutes instead of memory size. |
-m |
Show mean core size (this is the default). |
-q |
Don't print output records, just print average statistics. |
-r |
Show CPU factor: user_time/(system_time + user_time). |
-t |
Show separate system and user CPU times. |
-v |
Exclude column headings from the output. |
-C sec |
Show only processes with total CPU time (system plus user) exceeding sec seconds. |
-e time |
Show processes existing at or before time, given in the format hr[:min[:sec]]. |
-E time |
Show processes starting at or before time, given in the format hr[:min[:sec]]. Using the same time for both -S and -E, show processes that existed at the time. |
-g group |
Show only processes belonging to group. |
-H factor |
Show only processes that exceed factor, where factor is the "hog factor" (see the -h option). |
-I chars |
Show only processes transferring more characters than the cutoff number specified by chars. |
-l line |
Show only processes belonging to the terminal /dev/line. |
-n pattern |
Show only commands matching pattern (a regular expression except that "+" means one or more occurrences). |
-o ofile |
Instead of printing the records, copy them in acct.h format to ofile. |
-O sec |
Show only processes with CPU system time exceeding sec seconds. |
-s time |
Show processes existing at or after time, given in the format hr[:min[:sec]]. |
-S time |
Show processes starting at or after time, given in the format hr[:min[:sec]]. |
-u user |
Show only processes belonging to user. |