accounting: Preface
1
1 Preface
1 *******
1
1 Way back a long time ago, Thompson and Ritchie were sitting opposite one
1 another at the commissary, sipping coffees and discussing their evolving
1 behemoth.
1
1 "This behemoth of ours," said Ken, "is becoming rather popular,
1 wouldn't you say?" "Yes," said Dennis. "Every time I want to do a
1 compilation, I have to wait for hours and hours. It's infuriating."
1 They both agreed that the load on their system was too great. Both
1 sighed, picked up their mugs, and went back to the workbench. Little
1 did they know that an upper-management type was sitting just within
1 earshot of their conversation.
1
1 "We are AT&T Bell Laboratories, aren't we?" the upper-management type
1 thought to himself. "Well, what is our organization best known for?"
1 The brill-cream in his hair glistened. "Screwing people out of lots of
1 money, of course! If there were some way that we could keep tabs on
1 users and charge them through the nose for their CPU time..."
1
1 The accounting utilities were born.
1
1 Seriously though, the accouting utilities can provide a system
1 administrator with useful information about system usage--connections,
1 programs executed, and utilization of system resources.
1
1 Information about users--their connect time, location, programs
1 executed, and the like--is automatically recored in files by `init' and
1 `login'. Four of them are of interest to us: `wtmp', which has records
1 for each login and logout; `acct', which records each command that was
1 run; `usracct' and `savacct', which contain summaries of the
1 information in `acct' by user and command, respectively. Each of the
1 accounting utilities reports or summarizes information stored in these
1 files.
1
1 `ac'
1 prints statistics about users' connect time. `ac' can tell you how
1 long a particular user or group of users were connected to your
1 system, printing totals by day or for all of the entries in the
1 `wtmp' file.
1
1 `accton'
1 turns accounting on or off.
1
1 `lastcomm'
1 lists the commands executed on the system, most recent first,
1 showing the run state of each command. With `last', you can
1 search the `acct' file for a particular user, terminal, or command.
1
1 `sa'
1 summarizes the information in the `acct' file into the `savacct'
1 and `usracct' file. It also generates reports about commands,
1 giving the number of invocations, cpu time used, average core
1 usage, etc.
1
1 `dump-acct'
1 `dump-utmp'
1 display `acct' and `utmp' files in a human-readable format.
1
1
1 For more detailed information on any of these programs, check the
1 chapter with the program title.
1
1 A Note on File Names and Locations
1 ==================================
1
1 The `wtmp' and `acct' files seem to live in different places and have
1 different names for every variant of u*x that exists. The name `wtmp'
1 seems to be standard for the login accounting file, but the process
1 accounting file might be `acct' or `pacct' on your system. To find the
1 actual locations and names of these files on your system, specify the
1 `--help' flag to any of the programs in this package and the
1 information will dumped to standard output.
1
1 Regardless of the names and locations of files on your system, this
1 manual will refer to the login accounting file as `wtmp' and the
1 process accounting files as `acct', `savacct', and `usracct'.
1
1 Support for Multiple Accounting File Formats under Linux
1 ========================================================
1
1 The detailed format of the `acct' file written by the Linux kernel
1 varies depending on the kernel's version and configuration: Linux
1 kernels 2.6.7 and earlier write a v0 format `acct' file which
1 unfortunately cannot store user and group ids (`uid'/`gid') larger than
1 65535. Kernels 2.6.8 and later write the `acct' file in v1, v2 or v3
1 formats. (v3 if `BSD_PROCESS_ACCT_V3' is selected in the kernel
1 configuration, otherwise v1 if on the m68k architecture or v2
1 everywhere else).
1
1 Since version 6.4 the GNU accounting utilities on Linux systems are
1 able to read all of the v0, v2 and v3 file formats (v1 is not
1 supported). Thus you do not need to worry about the details given
1 above. You can even read `acct' files where different records were
1 written by differently configured kernels (you can find out about the
1 format of each entry by using the `dump-acct' utility). In case you
1 ever need to convert an `acct' file to a different format, the `--raw'
1 option of `dump-acct' does that together with the new `--format' and
1 `--byteswap' options that determine format and byte order of the output
1 file.
1
1 Multiformat support under Linux is intended to be a temporary
1 solution to aid in switching to the v3 `acct' file format. So do not
1 expect GNU acct 6.7 to still contain Multiformat support. In a few years
1 time, when everybody uses the v3 format, the ability to read multiple
1 formats at runtime will probably be dropped again from the GNU
1 accounting utilities. This does not, however, affect the ability to
1 adapt to the `acct' file format at compile time (when `./configure' is
1 run). Even GNU acct 6.3.5 (that does not know about multiple file
1 formats) will yield working binary programs when compiled under a (as
1 yet hypothetical) Linux kernel 2.6.62 that is only able to write the v3
1 format.
1
1 History of the Accounting Utilities
1 ===================================
1
1 I don't have any idea who originally wrote these utilities. If anybody
1 does, please send some mail to `noel@gnu.ai.mit.edu' and I'll add your
1 information here!
1
1 Since the first alpha versions of this software in late 1993, many
1 people have contributed to the package. They are (in alphabetical
1 order):
1
1 `Eric Backus <ericb@lsid.hp.com>'
1 Suggested fixes for HP-UX 9.05 using /bin/cc: configure assumed
1 you were using `gcc' and tacked on `-Wall' etc. He also noticed
1 that `file_rd.c' was doing pointer arithmetic on a `void *' pointer
1 (non-ANSI).
1
1 `Christoph Badura <bad@flatlin.ka.sub.org>'
1 Christoph was a BIG HELP in computing statistics, most notably
1 k*sec stuff! He also did Xenix testing and contributed some
1 Makefile fixes and output optimizations.
1
1 `Michael Calwas <calwas@ttd.teradyne.com>'
1 Fixed bugs in mktime.c.
1
1 `Derek Clegg <dclegg@apple.com>'
1 Suggested the simple, elegant fix for *_rd_never_used brain-damage.
1
1 `Alan Cox <iiitac@pyr.swan.ac.uk>'
1 Original Linux kernel accounting patches.
1
1 `Scott Crosby <root@hypercube.res.cmu.edu>'
1 Suggested idea behind `--sort-real-time' for `sa'.
1
1 `Solar Designer <solar@false.com>'
1 Added code for `--ahz' flag in `lastcomm' and `sa'.
1
1 `Dirk Eddelbuettel <edd@miles.econ.queensu.ca>'
1 Managed bug-fixes & etc. for Debian distribution, as well as the
1 architect of merge of GNU + Debian distributions. A big thanks to
1 Dirk for kicking me back into gear again after a long period of no
1 work on this project.
1
1 `Jason Grant <jamalcol@pc-5530.bc.rogers.wave.ca>'
1 Identified a buffer-overrun bug in `sa'.
1
1 `Kaveh R. Ghazi <ghazi@caip.rutgers.edu>'
1 Tested the package on many systems with compilers other than gcc.
1 Fixed K&R C support.
1
1 `Susan Kleinmann <sgk@sgk.tiac.net>'
1 Contributed excellent man pages!
1
1 `Alexander Kourakos <Alexander@Kourakos.com>'
1 Inspired the `--wide' option for `last'.
1
1 `Marek Michalkiewicz <marekm@i17linuxb.ists.pwr.wroc.pl>'
1 Suggested the `--ip-address' flag for `last'.
1
1 `David S. Miller <davem@caip.rutgers.edu>'
1 Noticed missing GNU-standard makefile rules.
1
1 `Walter Mueller <walt@pi4.informatik.uni-mannheim.de>'
1 Noticed install target was missing, and corrected a typo for
1 prefix in Makefile.in.
1
1 `Ian Murdock <imurdock@gnu.ai.mit.edu>'
1 Tracked down miscellaneous bugs in sa.c under Linux. Added Debian
1 package maintenance files.
1
1 `Tuomo Pyhala <tuomo@lesti.kpnet.fi>'
1 Reported buggy `--strict-match' flag in `lastcomm'.
1
1 `Tim Schmielau <tim@physik3.uni-rostock.de>'
1 Added Linux multiformat support.
1
1 `Luc I. Suryo <root@patriots.nl.mugnet.org>'
1 Suggested the `--user' flag for `lastcomm'.
1
1 `Pedro A M Vazquez <vazquez@iqm.unicamp.br>'
1 Fixed bugs in sa.c and tested under FreeBSD.
1
1 `Marco van Wieringen <Marco.van.Wieringen@mcs.nl.mugnet.org>'
1 Modified (wrote?) Linux kernel accounting patches.
1