The runacct shell script generates five basic reports upon each invocation. The following table describes the five basic reports generated.
Table 20–2 Daily Accounting Reports
Report Type |
Description |
---|---|
Shows terminal line utilization by tty number. |
|
Indicates usage of system resources by users (listed in order of user ID). |
|
Indicates usage of system resources by commands, listed in descending order of memory use. In other words, the command that used the most memory is listed first. This same information is reported for the month with the monthly command summary. |
|
A cumulative summary that reflects the data accumulated since the last invocation of the monacct program. |
|
Shows the last time each user logged in (arranged in chronological order). |
This report gives information about each terminal line used. The following is a sample Daily Report.
Oct 16 02:30 2001 DAILY REPORT FOR venus Page 1 from Mon Oct 15 02:30:02 2001 to Tue Oct 16 02:30:01 2001 1 runacct 1 acctcon TOTAL DURATION IS 1440 MINUTES LINE MINUTES PERCENT # SESS # ON # OFF console 868 60 1 1 2 TOTALS 868 -- 1 1 2 |
The from and to lines specify the time period reflected in the report. This time period covers the time the last Daily Report was generated to the time the current Daily Report was generated. Then, comes a log of system reboots, shutdowns, power failure recoveries, and any other record dumped into the /var/adm/wtmpx file by the acctwtmp program. For more information, see acct(1M).
The second part of the report is a breakdown of terminal line utilization. The TOTAL DURATION tells how long the system was in multiuser mode (accessible through the terminal lines). The following table describes the data provided in the Daily Report.
Table 20–3 Daily Report Data
During real time, you should monitor the /var/adm/wtmpx file because it is the file from which the connect accounting is derived. If the wtmpx file grows rapidly, execute the following command to see which tty line is the noisiest.
# /usr/lib/acct/acctcon -l file < /var/adm/wtmpx |
If interruption is occurring frequently, general system performance will be affected. Additionally, the wtmp file might become corrupted. To correct this problem, see How to Fix a Corrupted wtmpx File.
The Daily Usage Report gives a breakdown of system resource utilization by user. A sample of this report follows.
Oct 16 02:30 2001 DAILY USAGE REPORT FOR skisun Page 1 LOGIN CPU (MINS) KCORE- MINS CONNECT (MINS) DISK # OF # OF # DISK FEE UID NAME PRIME NPRIME PRIME NPRIME PRIME NPRIME BLOCKS PROCS SESS SAMPLES 0 TOTAL 72 148 11006173 51168 26230634 57792 539 330 0 2150 1 0 root 32 76 11006164 33664 26230616 22784 0 0 0 127 0 4 adm 0 0 22 51 0 0 0 420 0 0 0 101 rimmer 39 72 894385 1766020 539 330 0 1603 1 0 0 |
The following table describes the data provided in the Daily Usage Report.
Table 20–4 Daily Usage Report Data
The Daily Command Summary report shows the system resource use by command. With this report, you can identify the most heavily used commands and, based on how those commands use system resources, gain insight on how best to tune the system.
These reports are sorted by TOTAL KCOREMIN, which is an arbitrary gauge but often a good one for calculating drain on a system.
A sample daily command summary follows.
TOTAL COMMAND SUMMARY COMMAND NUMBER TOTAL TOTAL TOTAL MEAN MEAN HOG CHARS BLOCKS NAME CMDS KCOREMIN CPU-MIN REAL-MIN SIZE-K CPU-MIN FACTOR TRNSFD READ TOTALS 2150 1334999.75 219.59 724258.50 6079.48 0.10 0.00 397338982 419448 netscape 43 2456898.50 92.03 54503.12 26695.51 2.14 0.00 947774912 225568 adeptedi 7 88328.22 4.03 404.12 21914.95 0.58 0.01 93155160 8774 dtmail 1 54919.17 5.33 17716.57 10308.94 5.33 0.00 213843968 40192 acroread 8 31218.02 2.67 17744.57 11682.66 0.33 0.00 331454464 11260 dtwm 1 16252.93 2.53 17716.57 6416.05 2.53 0.00 158662656 12848 dtterm 5 4762.71 1.30 76300.29 3658.93 0.26 0.00 33828352 11604 dtaction 23 1389.72 0.33 0.60 4196.43 0.01 0.55 18653184 539 dtsessio 1 1174.87 0.24 17716.57 4932.97 0.24 0.00 23535616 5421 dtcm 1 866.30 0.18 17716.57 4826.21 0.18 0.00 3012096 6490 |
The following table describes the data provided in the Daily Command Summary.
Table 20–5 Daily Command Summary
Column |
Description |
---|---|
COMMAND NAME |
Name of the command. Unfortunately, all shell procedures are lumped together under the name sh because only object modules are reported by the process accounting system. You should monitor the frequency of programs called a.out or core or any other unexpected name. You can use the acctcom program to determine who executed an oddly named command and if superuser privileges were used. |
NUMBER CMDS |
Total number of times this command was run during prime time. |
TOTAL KCOREMIN |
Total cumulative measurement of the Kbyte segments of memory used by a process per minute of run time. |
TOTAL CPU-MIN |
Total processing time this program accumulated during prime time. |
TOTAL REAL-MIN |
Total real-time (wall-clock) minutes this program accumulated. |
MEAN SIZE-K |
Mean of the TOTAL KCOREMIN over the number of invocations reflected by NUMBER CMDS. |
MEAN CPU-MIN |
Mean derived between the NUMBER CMDS and TOTAL CPU-MIN. |
HOG FACTOR |
Total CPU time divided by elapsed time. Shows the ratio of system availability to system use, providing a relative measure of total available CPU time consumed by the process during its execution. |
CHARS TRNSFD |
Total number of characters pushed around by the read and write system calls. Might be negative due to overflow. |
BLOCKS READ |
Total number of the physical block reads and writes that a process performed. |
The format of the Daily Command Summary and the Monthly Command Summary reports are virtually the same. However, the daily summary reports only on the current accounting period while the monthly summary reports on the start of the fiscal period to the current date. In other words, the monthly report is a cumulative summary that reflects the data accumulated since the last invocation of the monacct program.
Oct 16 02:30 2001 MONTHLY TOTAL COMMAND SUMMARY Page 1 TOTAL COMMAND SUMMARY COMMAND NUMBER TOTAL TOTAL TOTAL MEAN MEAN HOG CHARS BLOCKS NAME CMDS KCOREMIN CPU-MIN REAL-MIN SIZE-K CPU-MIN FACTOR TRNSFD READ TOTALS 42718 4398793.50 361.92 956039.00 12154.09 0.01 0.00 16100942848 825171 netscape 789 3110437.25 121.03 79101.12 25699.58 0.15 0.00 3930527232 302486 adeptedi 84 1214419.00 50.20 4174.65 24193.62 0.60 0.01 890216640 107237 acroread 145 165297.78 7.01 18180.74 23566.84 0.05 0.00 1900504064 26053 dtmail 2 64208.90 6.35 20557.14 10112.43 3.17 0.00 250445824 43280 dtaction 800 47602.28 11.26 15.37 4226.93 0.01 0.73 640057536 8095 soffice. 13 35506.79 0.97 9.23 36510.84 0.07 0.11 134754320 5712 dtwm 2 20350.98 3.17 20557.14 6419.87 1.59 0.00 190636032 14049 |
For a description of the data provided in the Monthly Command Summary, see Daily Command Summary .
This report gives the date when a particular login was last used. You can use this information to find unused logins and login directories that can be archived and deleted. A sample report appears follows.
Oct 16 02:30 2001 LAST LOGIN Page 1 01-06-12 kryten 01-09-08 protoA 01-10-14 ripley 01-07-14 lister 01-09-08 protoB 01-10-15 scutter1 01-08-16 pmorph 01-10-12 rimmer 01-10-16 scutter2 |
At any time, you can examine the contents of the /var/adm/pacctn files, or any file with records in the acct.h format, by using the acctcom program. If you do not specify any files and do not provide any standard input when you run this command, the acctcom command reads the pacct file. Each record read by the acctcom command represents information about a terminated process. Active processes can be examined by running the ps command. The default output of the acctcom command provides the following information:
Sample acctcom output follows:
# acctcom COMMAND START END REAL CPU MEAN NAME USER TTYNAME TIME TIME (SECS) (SECS) SIZE(K) #accton root ? 02:30:01 02:30:01 0.03 0.01 304.00 turnacct adm ? 02:30:01 02:30:01 0.42 0.01 320.00 mv adm ? 02:30:01 02:30:01 0.07 0.01 504.00 utmp_upd adm ? 02:30:01 02:30:01 0.03 0.01 712.00 utmp_upd adm ? 02:30:01 02:30:01 0.01 0.01 824.00 utmp_upd adm ? 02:30:01 02:30:01 0.01 0.01 912.00 utmp_upd adm ? 02:30:01 02:30:01 0.01 0.01 920.00 utmp_upd adm ? 02:30:01 02:30:01 0.01 0.01 1136.00 utmp_upd adm ? 02:30:01 02:30:01 0.01 0.01 576.00 closewtm adm ? 02:30:01 02:30:01 0.10 0.01 664.00 |
Command name (pound (#) sign if the command was executed with superuser privileges)
User name
tty name (listed as ? if unknown)
Command starting time
Command ending time
Real time (in seconds)
CPU time (in seconds)
Mean size (in Kbytes)
You can obtain the following information by using acctcom options:
State of the fork/exec flag (1 for fork without exec)
System exit status
Hog factor
Total kcore minutes
CPU factor
Characters transferred
Blocks read
Option |
Description |
---|---|
-a |
Shows average statistics about the processes selected. The statistics are printed after the output is recorded. |
-b
|
Reads the files backward, showing latest commands first. This option has no effect if reading standard input. |
-f |
Prints the fork/exec flag and system exit status columns. The output is an octal number. |
-h |
Instead of mean memory size, shows the hog factor, which is the fraction of total available CPU time consumed by the process during its execution. Hog factor = total_CPU_time/elapsed_time. |
-i |
Prints columns containing the I/O counts in the output. |
-k |
Shows total kcore minutes instead of memory size. |
-m |
Shows mean core size. This is the default. |
-q |
Prints average statistics, not output records. |
-r |
Shows CPU factor: user_time/(system_time + user_time). |
-t |
Shows separate system and user CPU times. |
-v |
Excludes column headings from the output. |
-C sec |
Shows only processes with total CPU time (system plus user) exceeding sec seconds. |
-e time |
Shows processes existing at or before time, given in the format hr[:min[:sec]]. |
-E time |
Shows processes starting at or before time, given in the format hr[:min[:sec]]. Using the same time for both -S and -E, shows processes that existed at the time. |
-g group |
Shows only processes that belong to group. |
-H factor |
Shows only processes that exceed factor, where factor is the “hog factor” (see the -h option). |
-I chars |
Shows only processes that transferred more characters than the cutoff number specified by chars. |
-l line |
Show only processes belonging to the terminal /dev/line. |
-n pattern |
Shows only commands matching pattern (a regular expression except that “+” means one or more occurrences). |
-o ofile |
Instead of printing the records, copies them in acct.h format to ofile. |
-O sec |
Shows only processes with CPU system time exceeding sec seconds. |
-s time |
Show processes existing at or after time, given in the format hr[:min[:sec]]. |
-S time |
Show processes starting at or after time, given in the format hr[:min[:sec]]. |
-u user |
Shows only processes that belong to user. |